On Wed, Jun 19, 2019 at 01:53:02AM +0200, Michael Niedermayer wrote: > Fixes: shift exponent -100663046 is negative > Fixes: out of array access > Fixes: > 15270/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5727829913763840 > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > --- > libavcodec/iff.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/libavcodec/iff.c b/libavcodec/iff.c > index 33cf2e3a94..48a0340604 100644 > --- a/libavcodec/iff.c > +++ b/libavcodec/iff.c > @@ -382,7 +382,7 @@ static av_cold int decode_init(AVCodecContext *avctx) > IffContext *s = avctx->priv_data; > int err; > > - if (avctx->bits_per_coded_sample <= 8) { > + if (avctx->bits_per_coded_sample <= 8U) { > int palette_size; > > if (avctx->extradata_size >= 2) > @@ -391,7 +391,7 @@ static av_cold int decode_init(AVCodecContext *avctx) > palette_size = 0; > avctx->pix_fmt = (avctx->bits_per_coded_sample < 8) || > (avctx->extradata_size >= 2 && palette_size) ? > AV_PIX_FMT_PAL8 : AV_PIX_FMT_GRAY8; > - } else if (avctx->bits_per_coded_sample <= 32) { > + } else if (avctx->bits_per_coded_sample <= 32U) { > if (avctx->codec_tag == MKTAG('R', 'G', 'B', '8')) { > avctx->pix_fmt = AV_PIX_FMT_RGB32; > } else if (avctx->codec_tag == MKTAG('R', 'G', 'B', 'N')) { > -- > 2.21.0
hey michael, can you post the test case file? AVCodecParameters.bits_per_coded_sample is signed, but looking at *libavformat*/iff.c, i can't fathom how its getting below zero. -- Peter (A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
signature.asc
Description: PGP signature
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
