Chiebot-Mirror
/
FFmpeg
mirror of https://github.com/FFmpeg/FFmpeg.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/hevc_ps: Avoid signed overflow before check on QP

Browse Source 
Fixes: signed integer overflow: -2147483648 - 5 cannot be represented in type 'int'
Fixes: 58066/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5312995835379712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
pull/389/head
Michael Niedermayer 2 years ago
parent 69eb8197af
commit bf3f91c425
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 3 additions and 3 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 6
      libavcodec/hevc_ps.c

6
libavcodec/hevc_ps.c
Unescape View File

@ -1529,9 +1529,9 @@ static int pps_scc_extension(GetBitContext *gb, AVCodecContext *avctx,
pps->pps_curr_pic_ref_enabled_flag = get_bits1(gb);
if (pps->residual_adaptive_colour_transform_enabled_flag = get_bits1(gb)) {
pps->pps_slice_act_qp_offsets_present_flag = get_bits1(gb);
pps->pps_act_y_qp_offset = get_se_golomb_long(gb) - 5;
pps->pps_act_cb_qp_offset = get_se_golomb_long(gb) - 5;
pps->pps_act_cr_qp_offset = get_se_golomb_long(gb) - 3;
pps->pps_act_y_qp_offset = get_se_golomb(gb) - 5;
pps->pps_act_cb_qp_offset = get_se_golomb(gb) - 5;
pps->pps_act_cr_qp_offset = get_se_golomb(gb) - 3;
#define CHECK_QP_OFFSET(name) (pps->pps_act_ ## name ## _qp_offset <= -12 || \
pps->pps_act_ ## name ## _qp_offset >= 12)

Write Preview
Loading…
Cancel
Save