[FFmpeg-cvslog] avcodec/jpeglsdec: Increase range for N in ls_get_code_runterm() by using unsigned
Michael Niedermayer
git at videolan.org
Wed Apr 6 22:55:49 EEST 2022
ffmpeg | branch: release/4.3 | Michael Niedermayer <michael at niedermayer.cc> | Sat Feb 5 20:41:08 2022 +0100| [228d0067903f34054c797907458206d943faf0ab] | committer: Michael Niedermayer
avcodec/jpeglsdec: Increase range for N in ls_get_code_runterm() by using unsigned
Fixes: left shift of 32768 by 16 places cannot be represented in type 'int'
Fixes: Timeout
Fixes: 44219/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-4679455379947520
Fixes: 44088/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-4885976600674304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 6ee283d7d001cfcfec94a023e172bca731e96514)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=228d0067903f34054c797907458206d943faf0ab
---
libavcodec/jpeglsdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/jpeglsdec.c b/libavcodec/jpeglsdec.c
index df7c5fadae..6295c03ffa 100644
--- a/libavcodec/jpeglsdec.c
+++ b/libavcodec/jpeglsdec.c
@@ -186,7 +186,7 @@ static inline int ls_get_code_runterm(GetBitContext *gb, JLSState *state,
if (RItype)
temp += state->N[Q] >> 1;
- for (k = 0; (state->N[Q] << k) < temp; k++)
+ for (k = 0; ((unsigned)state->N[Q] << k) < temp; k++)
;
#ifdef JLS_BROKEN
More information about the ffmpeg-cvslog
mailing list