highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/aacdec_template (fixed point): Check gain in decode_cce() to avoid undefined shifts later

Browse Source 
Fixes: runtime error: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 2581/clusterfuzz-testcase-minimized-4681474395602944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2886142e0c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2017-07-15 22:22:52 +02:00
parent a2c3c9bc60
commit 02bec657f3
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/aacdec_template.c
View File

@@ -2173,6 +2173,10 @@ static int decode_cce(AACContext *ac, GetBitContext *gb, ChannelElement *che)
cge = coup->coupling_point == AFTER_IMDCT ? 1 : get_bits1(gb); cge = coup->coupling_point == AFTER_IMDCT ? 1 : get_bits1(gb);
gain = cge ? get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60: 0; gain = cge ? get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60: 0;
gain_cache = GET_GAIN(scale, gain); gain_cache = GET_GAIN(scale, gain);
#if USE_FIXED
if ((abs(gain_cache)-1024) >> 3 > 30)
return AVERROR(ERANGE);
#endif
} }
if (coup->coupling_point == AFTER_IMDCT) { if (coup->coupling_point == AFTER_IMDCT) {
coup->gain[c][0] = gain_cache; coup->gain[c][0] = gain_cache;
@@ -2190,6 +2194,10 @@ static int decode_cce(AACContext *ac, GetBitContext *gb, ChannelElement *che)
t >>= 1; t >>= 1;
} }
gain_cache = GET_GAIN(scale, t) * s; gain_cache = GET_GAIN(scale, t) * s;
#if USE_FIXED
if ((abs(gain_cache)-1024) >> 3 > 30)
return AVERROR(ERANGE);
#endif
} }
} }
coup->gain[c][idx] = gain_cache; coup->gain[c][idx] = gain_cache;