avcodec/av1dec: Fix resolving zero divisor

Fixes: Out of array read
Fixes: global-buffer-overflow-AV1

Found-by: "Leonelli, Matteo" <matteo.leonelli@cispa.de>
Tested-by: "Wang, Fei W" <fei.w.wang@intel.com>
Reviewed-by: "Wang, Fei W" <fei.w.wang@intel.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 22daf2148f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
pull/390/head
Michael Niedermayer 1 year ago
parent f946c6c2f0
commit d93b0009c4
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
  1. 2
      libavcodec/av1dec.c

@ -177,7 +177,7 @@ static uint8_t get_shear_params_valid(AV1DecContext *s, int idx)
int16_t alpha, beta, gamma, delta, divf, divs;
int64_t v, w;
int32_t *param = &s->cur_frame.gm_params[idx][0];
if (param[2] < 0)
if (param[2] <= 0)
return 0;
alpha = av_clip_int16(param[2] - (1 << AV1_WARPEDMODEL_PREC_BITS));

Loading…
Cancel
Save