[FFmpeg-devel] [PATCH 1/6] avcodec/alac: Check for bps of 0

[Michael Niedermayer]

On Sun, Aug 25, 2019 at 05:46:10PM -0300, James Almer wrote:
> On 8/25/2019 3:41 PM, Michael Niedermayer wrote:
> > Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
> > Fixes: 15764/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5102101203517440
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >  libavcodec/alac.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/libavcodec/alac.c b/libavcodec/alac.c
> > index 6086e2caa8..782d461b22 100644
> > --- a/libavcodec/alac.c
> > +++ b/libavcodec/alac.c
> > @@ -250,10 +250,12 @@ static int decode_element(AVCodecContext *avctx, AVFrame *frame, int ch_index,
> >  
> >      alac->extra_bits = get_bits(&alac->gb, 2) << 3;
> >      bps = alac->sample_size - alac->extra_bits + channels - 1;
> > -    if (bps > 32U) {
> > +    if (bps > 32) {
> >          avpriv_report_missing_feature(avctx, "bps %d", bps);
> >          return AVERROR_PATCHWELCOME;
> >      }
> > +    if (bps < 1)
> > +        return AVERROR_INVALIDDATA;
> >  
> >      /* whether the frame is compressed */
> >      is_compressed = !get_bits1(&alac->gb);
> 
> LGTM.

will apply

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Dictatorship: All citizens are under surveillance, all their steps and
actions recorded, for the politicians to enforce control.
Democracy: All politicians are under surveillance, all their steps and
actions recorded, for the citizens to enforce control.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: not available
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20190825/b2225cde/attachment.sig>