[FFmpeg-cvslog] avformat/vividas: Fixes overflow in shift in recover_key()

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Fri Jun 28 21:03:59 2019 +0200| [62d10ec35c3055a153b08f51d844932f19ed66e7] | committer: Michael Niedermayer

avformat/vividas: Fixes overflow in shift in recover_key()

Fixes: left shift of 133 by 24 places cannot be represented in type 'int'
Fixes: 15365/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5716153105645568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Reimar Döffinger <Reimar.Doeffinger at gmx.de>
Reviewed-by: Reimar Döffinger <Reimar.Doeffinger at gmx.de>
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=62d10ec35c3055a153b08f51d844932f19ed66e7
---

 libavformat/vividas.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/libavformat/vividas.c b/libavformat/vividas.c
index 350c7aa70a..830e318645 100644
--- a/libavformat/vividas.c
+++ b/libavformat/vividas.c
@@ -115,10 +115,7 @@ static unsigned recover_key(unsigned char sample[4], unsigned expected_size)
 
     put_v(plaintext+2, expected_size);
 
-    return (sample[0]^plaintext[0])|
-        ((sample[1]^plaintext[1])<<8)|
-        ((sample[2]^plaintext[2])<<16)|
-        ((sample[3]^plaintext[3])<<24);
+    return AV_RL32(sample) ^ AV_RL32(plaintext);
 }
 
 static void xor_block(void *p1, void *p2, unsigned size, int key, unsigned *key_ptr)