diff --git a/libavformat/oggparsedaala.c b/libavformat/oggparsedaala.c index 24567f93a9..3651ca188b 100644 --- a/libavformat/oggparsedaala.c +++ b/libavformat/oggparsedaala.c @@ -123,7 +123,12 @@ static int daala_header(AVFormatContext *s, int idx) hdr->frame_duration = bytestream2_get_ne32(&gb); hdr->gpshift = bytestream2_get_byte(&gb); - hdr->gpmask = (1 << hdr->gpshift) - 1; + if (hdr->gpshift >= 32) { + av_log(s, AV_LOG_ERROR, "Too large gpshift %d (>= 32).\n", + hdr->gpshift); + return AVERROR_INVALIDDATA; + } + hdr->gpmask = (1U << hdr->gpshift) - 1; hdr->format.depth = 8 + 2*(bytestream2_get_byte(&gb)-1); diff --git a/libavformat/oggparsetheora.c b/libavformat/oggparsetheora.c index 6e6a362e1e..5f057c3c8a 100644 --- a/libavformat/oggparsetheora.c +++ b/libavformat/oggparsetheora.c @@ -108,7 +108,7 @@ static int theora_header(AVFormatContext *s, int idx) skip_bits(&gb, 2); thp->gpshift = get_bits(&gb, 5); - thp->gpmask = (1 << thp->gpshift) - 1; + thp->gpmask = (1U << thp->gpshift) - 1; st->codec->codec_type = AVMEDIA_TYPE_VIDEO; st->codec->codec_id = AV_CODEC_ID_THEORA;