RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/wavpack: Fix overflow in p=31 

Untested with "non fuzzed" samples as i have no such file
The reference 5.6.0 decoder appears to also have undefined behavior in the lossless codepath for this

Fixes: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 50930/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-6319201949712384

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2022-09-11 12:00:31 +02:00
parent ee650398ec
commit 9bfae83856
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/wavpack.c
View File

@ -126,7 +126,7 @@ static av_always_inline unsigned get_tail(GetBitContext *gb, unsigned k)
if (k < 1) if (k < 1)
return 0; return 0;
p = av_log2(k); p = av_log2(k);
e = (1 << (p + 1)) - k - 1; e = (1LL << (p + 1)) - k - 1;
res = get_bits_long(gb, p); res = get_bits_long(gb, p);
if (res >= e) if (res >= e)
res = (res << 1) - e + get_bits1(gb); res = (res << 1) - e + get_bits1(gb);