From 1a81a40de265df6c5e4e6bb924c5f3c219904f41 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 7 Aug 2023 00:19:09 +0200 Subject: [PATCH] avcodec/wavarc: Check shift Fixes: shift exponent 1285 is too large for 32-bit type 'int' Fixes: 60870/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-5332050340347904 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/wavarc.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/libavcodec/wavarc.c b/libavcodec/wavarc.c index 8e4c7d17dc..0dc5849679 100644 --- a/libavcodec/wavarc.c +++ b/libavcodec/wavarc.c @@ -218,6 +218,10 @@ static int decode_1dif(AVCodecContext *avctx, continue; case 6: s->shift = get_urice(gb, 2); + if ((unsigned)s->shift > 31) { + s->shift = 0; + return AVERROR_INVALIDDATA; + } continue; case 5: if (avctx->sample_fmt == AV_SAMPLE_FMT_U8P) { @@ -314,6 +318,10 @@ static int decode_2slp(AVCodecContext *avctx, continue; case 7: s->shift = get_urice(gb, 2); + if ((unsigned)s->shift > 31) { + s->shift = 0; + return AVERROR_INVALIDDATA; + } continue; case 6: if (avctx->sample_fmt == AV_SAMPLE_FMT_U8P) { @@ -586,6 +594,10 @@ static int decode_5elp(AVCodecContext *avctx, continue; case 10: s->shift = get_urice(gb, 2); + if ((unsigned)s->shift > 31) { + s->shift = 0; + return AVERROR_INVALIDDATA; + } continue; case 9: if (avctx->sample_fmt == AV_SAMPLE_FMT_U8P) {