RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/wavpack: Check rate_x and sample rate for overflow 

Fixes: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 21647/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5686168323883008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: David Bryant <david@wavpack.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2020-05-02 21:20:45 +02:00
parent 94f4fab69f
commit 30f5d67510
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
libavcodec/wavpack.c
View File

@ -1359,7 +1359,10 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no,
bytestream2_skip(&gb, ssize); bytestream2_skip(&gb, ssize);
continue; continue;
} }
rate_x = 1 << bytestream2_get_byte(&gb); rate_x = bytestream2_get_byte(&gb);
if (rate_x > 30)
return AVERROR_INVALIDDATA;
rate_x = 1 << rate_x;
dsd_mode = bytestream2_get_byte(&gb); dsd_mode = bytestream2_get_byte(&gb);
if (dsd_mode && dsd_mode != 1 && dsd_mode != 3) { if (dsd_mode && dsd_mode != 1 && dsd_mode != 3) {
av_log(avctx, AV_LOG_ERROR, "Invalid DSD encoding mode: %d\n", av_log(avctx, AV_LOG_ERROR, "Invalid DSD encoding mode: %d\n",
@ -1498,9 +1501,13 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no,
av_log(avctx, AV_LOG_ERROR, "Custom sample rate missing.\n"); av_log(avctx, AV_LOG_ERROR, "Custom sample rate missing.\n");
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
new_samplerate = sample_rate * rate_x; new_samplerate = sample_rate;
} else } else
new_samplerate = wv_rates[sr] * rate_x; new_samplerate = wv_rates[sr];
if (new_samplerate * (uint64_t)rate_x > INT_MAX)
return AVERROR_INVALIDDATA;
new_samplerate *= rate_x;
if (multiblock) { if (multiblock) {
if (chan) if (chan)