[FFmpeg-devel] [PATCH 1/2] avcodec/mpeg12dec: Fix invalid shift in mpeg2_fast_decode_block_intra()

[Kieran Kunhya]

On Thu, 26 Dec 2019 at 00:27, Michael Niedermayer <michael at niedermayer.cc>
wrote:

> Fixes: left shift of negative value -695
> Fixes:
> 19232/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5702856963522560
> Fixes:
> 19555/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5741218147598336
>
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by
> <https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by>:
> Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/mpeg12dec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libavcodec/mpeg12dec.c b/libavcodec/mpeg12dec.c
> index 775579f9f0..4643992d28 100644
> --- a/libavcodec/mpeg12dec.c
> +++ b/libavcodec/mpeg12dec.c
> @@ -586,7 +586,7 @@ static inline int
> mpeg2_fast_decode_block_intra(MpegEncContext *s,


Can we not remove this "fast" code? Decoding MPEG-2 is not exactly hard in
2019.
Also it has the following comment associated with it:

/**
 * Note: this function can read out of range and crash for corrupt streams.
 * Changing this would eat up any speed benefits it has.
 * Do not use "fast" flag if you need the code to be robust.
 */

If you want to make it robust you might as well just use the real decode
function

Kieran