[FFmpeg-devel] [PATCH] avcodec/dirac_vlc: limit res_bits in APPEND_RESIDUE()

[Michael Niedermayer]

Fixes: runtime error: left shift of 1073741838 by 1 places cannot be represented in type 'int32_t' (aka 'int')
Fixes: 3279/clusterfuzz-testcase-minimized-4564805744590848

Suggested-by: <atomnuker>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavcodec/dirac_vlc.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/libavcodec/dirac_vlc.c b/libavcodec/dirac_vlc.c
index bd37f31f46..bb525f89d8 100644
--- a/libavcodec/dirac_vlc.c
+++ b/libavcodec/dirac_vlc.c
@@ -37,7 +37,7 @@
 
 #define APPEND_RESIDUE(N, M)                                                   \
     N          |= M >> (N ## _bits);                                           \
-    N ## _bits +=      (M ## _bits)
+    N ## _bits  = (N ## _bits + (M ## _bits)) & 63
 
 int ff_dirac_golomb_read_32bit(DiracGolombLUT *lut_ctx, const uint8_t *buf,
                                int bytes, uint8_t *_dst, int coeffs)
@@ -56,9 +56,6 @@ int ff_dirac_golomb_read_32bit(DiracGolombLUT *lut_ctx, const uint8_t *buf,
         if ((c_idx + 1) > coeffs)
             return c_idx;
 
-        if (res_bits >= RSIZE_BITS)
-            res_bits = res = 0;
-
         /* res_bits is a hint for better branch prediction */
         if (res_bits && l->sign) {
             int32_t coeff = 1;
@@ -99,9 +96,6 @@ int ff_dirac_golomb_read_16bit(DiracGolombLUT *lut_ctx, const uint8_t *buf,
         if ((c_idx + 1) > coeffs)
             return c_idx;
 
-        if (res_bits >= RSIZE_BITS)
-            res_bits = res = 0;
-
         if (res_bits && l->sign) {
             int32_t coeff = 1;
             APPEND_RESIDUE(res, l->preamble);
-- 
2.14.1