[FFmpeg-devel] [PATCH 7/8] avcodec/vvc/cabac: Check k in kth_order_egk_decode()

[Michael Niedermayer]

The return value is int we can thus not handle 31 or more bits

Fixes: integer overflow
Fixes: 418396701/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-4730994378997760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavcodec/vvc/cabac.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/vvc/cabac.c b/libavcodec/vvc/cabac.c
index 6847ce59aff..78703cb065e 100644
--- a/libavcodec/vvc/cabac.c
+++ b/libavcodec/vvc/cabac.c
@@ -937,6 +937,8 @@ static int kth_order_egk_decode(CABACContext *c, int k)
 
     while (bit) {
         bit = get_cabac_bypass(c);
+        if (k >= 31)
+            return AVERROR_PATCHWELCOME;
         value += bit << k++;
     }
 
-- 
2.49.0