[FFmpeg-devel] [PATCH] avcodec/cbs_av1: Use unsigned to avoid undefined shift

[Michael Niedermayer]

On Thu, Jun 18, 2020 at 02:41:22PM +0200, Andreas Rheinhardt wrote:
> Fixes: assertion failure
> Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
> Fixes: 23264/clusterfuzz-testcase-minimized-ffmpeg_BSF_AV1_METADATA_fuzzer-6308429248593920
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> 
> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt at gmail.com>
> ---
>  libavcodec/cbs_av1.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavcodec/cbs_av1.c b/libavcodec/cbs_av1.c
> index 29b316e011..7af63e2165 100644
> --- a/libavcodec/cbs_av1.c
> +++ b/libavcodec/cbs_av1.c
> @@ -125,7 +125,7 @@ static int cbs_av1_write_uvlc(CodedBitstreamContext *ctx, PutBitContext *pbc,
>          put_bits(pbc, 1, 1);
>      } else {
>          zeroes = av_log2(value + 1);
> -        v = value - (1 << zeroes) + 1;
> +        v = value - (1U << zeroes) + 1;
>          put_bits(pbc, zeroes + 1, 1);

thats not valid, the put bits wont handle that
but as i see another patchset following later, i guess that has been noticed already

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The educated differ from the uneducated as much as the living from the
dead. -- Aristotle 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20200618/366f3d4a/attachment.sig>