Fixes: signed integer overflow: 57342 * 120830 cannot be represented in type 'int' Fixes: 16426/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-5758744817827840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg --- libavcodec/cfhd.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/libavcodec/cfhd.c b/libavcodec/cfhd.c index 27eed415d1..b4d6b25cbc 100644 --- a/libavcodec/cfhd.c +++ b/libavcodec/cfhd.c @@ -625,8 +625,12 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame, ret = ff_set_dimensions(avctx, s->coded_width, s->coded_height); if (ret < 0) return ret; - if (s->cropped_height) - avctx->height = s->cropped_height << (avctx->pix_fmt == AV_PIX_FMT_BAYER_RGGB16); + if (s->cropped_height) { + unsigned height = s->cropped_height << (avctx->pix_fmt == AV_PIX_FMT_BAYER_RGGB16); + if (avctx->height < height) + return AVERROR_INVALIDDATA; + avctx->height = height; + } frame.f->width = frame.f->height = 0; -- 2.23.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
