[FFmpeg-devel] [PATCH 2/3] avcodec/iff: Check bpp for validity

[Michael Niedermayer]

Fixes: shift exponent -100663046 is negative
Fixes: out of array access
Fixes: 15270/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5727829913763840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavcodec/iff.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/iff.c b/libavcodec/iff.c
index 33cf2e3a94..48a0340604 100644
--- a/libavcodec/iff.c
+++ b/libavcodec/iff.c
@@ -382,7 +382,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
     IffContext *s = avctx->priv_data;
     int err;
 
-    if (avctx->bits_per_coded_sample <= 8) {
+    if (avctx->bits_per_coded_sample <= 8U) {
         int palette_size;
 
         if (avctx->extradata_size >= 2)
@@ -391,7 +391,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
             palette_size = 0;
         avctx->pix_fmt = (avctx->bits_per_coded_sample < 8) ||
                          (avctx->extradata_size >= 2 && palette_size) ? AV_PIX_FMT_PAL8 : AV_PIX_FMT_GRAY8;
-    } else if (avctx->bits_per_coded_sample <= 32) {
+    } else if (avctx->bits_per_coded_sample <= 32U) {
         if (avctx->codec_tag == MKTAG('R', 'G', 'B', '8')) {
             avctx->pix_fmt = AV_PIX_FMT_RGB32;
         } else if (avctx->codec_tag == MKTAG('R', 'G', 'B', 'N')) {
-- 
2.21.0