RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/hevc_ps: Fix integer overflow with beta/tc offsets 

Fixes: runtime error: signed integer overflow: 2113929216 * 2 cannot be represented in type 'int'
Fixes: 2422/clusterfuzz-testcase-minimized-5242114713583616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-06-30 16:23:32 +02:00
parent 9e392c6ece
commit de54a37c1d
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
libavcodec/hevc_ps.c
View File

@ -1602,20 +1602,22 @@ int ff_hevc_decode_nal_pps(GetBitContext *gb, AVCodecContext *avctx,
pps->deblocking_filter_override_enabled_flag = get_bits1(gb);
pps->disable_dbf = get_bits1(gb);
if (!pps->disable_dbf) {
pps->beta_offset = get_se_golomb(gb) * 2;
pps->tc_offset = get_se_golomb(gb) * 2;
if (pps->beta_offset/2 < -6 || pps->beta_offset/2 > 6) {
int beta_offset_div2 = get_se_golomb(gb);
int tc_offset_div2 = get_se_golomb(gb) ;
if (beta_offset_div2 < -6 || beta_offset_div2 > 6) {
av_log(avctx, AV_LOG_ERROR, "pps_beta_offset_div2 out of range: %d\n",
pps->beta_offset/2);
beta_offset_div2);
ret = AVERROR_INVALIDDATA;
goto err;
}
if (pps->tc_offset/2 < -6 || pps->tc_offset/2 > 6) {
if (tc_offset_div2 < -6 || tc_offset_div2 > 6) {
av_log(avctx, AV_LOG_ERROR, "pps_tc_offset_div2 out of range: %d\n",
pps->tc_offset/2);
tc_offset_div2);
ret = AVERROR_INVALIDDATA;
goto err;
}
pps->beta_offset = 2 * beta_offset_div2;
pps->tc_offset = 2 * tc_offset_div2;
}
}