[FFmpeg-cvslog] avcodec/hevc_ps: Fix integer overflow with beta/tc offsets
Michael Niedermayer
git at videolan.org
Thu Aug 24 15:08:08 EEST 2017
ffmpeg | branch: release/2.8 | Michael Niedermayer <michael at niedermayer.cc> | Fri Jun 30 16:23:32 2017 +0200| [a5e969dd28c2f6f5b2c322cb1856338f6e206ca1] | committer: Michael Niedermayer
avcodec/hevc_ps: Fix integer overflow with beta/tc offsets
Fixes: runtime error: signed integer overflow: 2113929216 * 2 cannot be represented in type 'int'
Fixes: 2422/clusterfuzz-testcase-minimized-5242114713583616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit de54a37c1dfa2817b5838720fac44e82312ccbfd)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a5e969dd28c2f6f5b2c322cb1856338f6e206ca1
---
libavcodec/hevc_ps.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c
index 02b64546c2..dcb1f7d27f 100644
--- a/libavcodec/hevc_ps.c
+++ b/libavcodec/hevc_ps.c
@@ -1553,20 +1553,22 @@ int ff_hevc_decode_nal_pps(GetBitContext *gb, AVCodecContext *avctx,
pps->deblocking_filter_override_enabled_flag = get_bits1(gb);
pps->disable_dbf = get_bits1(gb);
if (!pps->disable_dbf) {
- pps->beta_offset = get_se_golomb(gb) * 2;
- pps->tc_offset = get_se_golomb(gb) * 2;
- if (pps->beta_offset/2 < -6 || pps->beta_offset/2 > 6) {
+ int beta_offset_div2 = get_se_golomb(gb);
+ int tc_offset_div2 = get_se_golomb(gb) ;
+ if (beta_offset_div2 < -6 || beta_offset_div2 > 6) {
av_log(avctx, AV_LOG_ERROR, "pps_beta_offset_div2 out of range: %d\n",
- pps->beta_offset/2);
+ beta_offset_div2);
ret = AVERROR_INVALIDDATA;
goto err;
}
- if (pps->tc_offset/2 < -6 || pps->tc_offset/2 > 6) {
+ if (tc_offset_div2 < -6 || tc_offset_div2 > 6) {
av_log(avctx, AV_LOG_ERROR, "pps_tc_offset_div2 out of range: %d\n",
- pps->tc_offset/2);
+ tc_offset_div2);
ret = AVERROR_INVALIDDATA;
goto err;
}
+ pps->beta_offset = 2 * beta_offset_div2;
+ pps->tc_offset = 2 * tc_offset_div2;
}
}
More information about the ffmpeg-cvslog
mailing list