virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-04 22:03:09 +02:00
Code Issues Releases Activity

avcodec/aac/aacdec_lpd: Limit get_unary()

Browse Source 
The limit is based on later code storing 32bits

Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 393164866/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-4606798354513920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2025-02-08 22:16:38 +01:00
parent 41cd72d76e
commit 464fb861b1
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
libavcodec/aac/aacdec_lpd.c
View File

@@ -62,7 +62,7 @@ static void parse_qn(GetBitContext *gb, int *qn, int nk_mode, int no_qn)
{ {
if (nk_mode == 1) { if (nk_mode == 1) {
for (int k = 0; k < no_qn; k++) { for (int k = 0; k < no_qn; k++) {
qn[k] = get_unary(gb, 0, INT32_MAX); // TODO: find proper ranges qn[k] = get_unary(gb, 0, 68); // TODO: find proper ranges
if (qn[k]) if (qn[k])
qn[k]++; qn[k]++;
} }
@@ -75,7 +75,7 @@ static void parse_qn(GetBitContext *gb, int *qn, int nk_mode, int no_qn)
if (nk_mode == 2) { if (nk_mode == 2) {
for (int k = 0; k < no_qn; k++) { for (int k = 0; k < no_qn; k++) {
if (qn[k] > 4) { if (qn[k] > 4) {
qn[k] = get_unary(gb, 0, INT32_MAX);; qn[k] = get_unary(gb, 0, 65);
if (qn[k]) if (qn[k])
qn[k] += 4; qn[k] += 4;
} }
@@ -85,7 +85,7 @@ static void parse_qn(GetBitContext *gb, int *qn, int nk_mode, int no_qn)
for (int k = 0; k < no_qn; k++) { for (int k = 0; k < no_qn; k++) {
if (qn[k] > 4) { if (qn[k] > 4) {
int qn_ext = get_unary(gb, 0, INT32_MAX);; int qn_ext = get_unary(gb, 0, 65);
switch (qn_ext) { switch (qn_ext) {
case 0: qn[k] = 5; break; case 0: qn[k] = 5; break;
case 1: qn[k] = 6; break; case 1: qn[k] = 6; break;
@@ -114,6 +114,9 @@ static int parse_codebook_idx(GetBitContext *gb, uint32_t *kv,
} }
} }
if (nk > 25)
return AVERROR_PATCHWELCOME;
skip_bits(gb, 4*n); skip_bits(gb, 4*n);
if (nk > 0) if (nk > 0)