diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-06-27 14:11:00 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-06-27 23:21:12 +0200 |
| commit | 2c874548d663225a61b9c25a8b2ce490d26b65fa (patch) | |
| tree | c0617ba9952fa790f2d8fc67523862cd4bfe99de /libavcodec | |
| parent | 35a5d9715dd82fd00f1d1401ec6be2d3e2eea81c (diff) | |
| download | ffmpeg-streaming-2c874548d663225a61b9c25a8b2ce490d26b65fa.zip ffmpeg-streaming-2c874548d663225a61b9c25a8b2ce490d26b65fa.tar.gz | |
avcodec/hevcdec: do basic validity check on delta_chroma_weight and offset
Fixes: runtime error: signed integer overflow: 2147483520 + 128 cannot be represented in type 'int'
Fixes: 2385/clusterfuzz-testcase-minimized-6594333576790016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/hevcdec.c | 19 |
1 files changed, 17 insertions, 2 deletions
diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c index f6bc5ef..095564b 100644 --- a/libavcodec/hevcdec.c +++ b/libavcodec/hevcdec.c @@ -139,7 +139,7 @@ fail: return AVERROR(ENOMEM); } -static void pred_weight_table(HEVCContext *s, GetBitContext *gb) +static int pred_weight_table(HEVCContext *s, GetBitContext *gb) { int i = 0; int j = 0; @@ -182,6 +182,12 @@ static void pred_weight_table(HEVCContext *s, GetBitContext *gb) for (j = 0; j < 2; j++) { int delta_chroma_weight_l0 = get_se_golomb(gb); int delta_chroma_offset_l0 = get_se_golomb(gb); + + if ( (int8_t)delta_chroma_weight_l0 != delta_chroma_weight_l0 + || delta_chroma_offset_l0 < -(1<<17) || delta_chroma_offset_l0 > (1<<17)) { + return AVERROR_INVALIDDATA; + } + s->sh.chroma_weight_l0[i][j] = (1 << s->sh.chroma_log2_weight_denom) + delta_chroma_weight_l0; s->sh.chroma_offset_l0[i][j] = av_clip((delta_chroma_offset_l0 - ((128 * s->sh.chroma_weight_l0[i][j]) >> s->sh.chroma_log2_weight_denom) + 128), -128, 127); @@ -218,6 +224,12 @@ static void pred_weight_table(HEVCContext *s, GetBitContext *gb) for (j = 0; j < 2; j++) { int delta_chroma_weight_l1 = get_se_golomb(gb); int delta_chroma_offset_l1 = get_se_golomb(gb); + + if ( (int8_t)delta_chroma_weight_l1 != delta_chroma_weight_l1 + || delta_chroma_offset_l1 < -(1<<17) || delta_chroma_offset_l1 > (1<<17)) { + return AVERROR_INVALIDDATA; + } + s->sh.chroma_weight_l1[i][j] = (1 << s->sh.chroma_log2_weight_denom) + delta_chroma_weight_l1; s->sh.chroma_offset_l1[i][j] = av_clip((delta_chroma_offset_l1 - ((128 * s->sh.chroma_weight_l1[i][j]) >> s->sh.chroma_log2_weight_denom) + 128), -128, 127); @@ -230,6 +242,7 @@ static void pred_weight_table(HEVCContext *s, GetBitContext *gb) } } } + return 0; } static int decode_lt_rps(HEVCContext *s, LongTermRPS *rps, GetBitContext *gb) @@ -692,7 +705,9 @@ static int hls_slice_header(HEVCContext *s) if ((s->ps.pps->weighted_pred_flag && sh->slice_type == HEVC_SLICE_P) || (s->ps.pps->weighted_bipred_flag && sh->slice_type == HEVC_SLICE_B)) { - pred_weight_table(s, gb); + int ret = pred_weight_table(s, gb); + if (ret < 0) + return ret; } sh->max_num_merge_cand = 5 - get_ue_golomb_long(gb); |
