diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-11-14 22:27:00 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-11-21 22:09:51 +0100 |
| commit | a108a4d809f8345303e1aa7578d608a726c53686 (patch) | |
| tree | 3dfb7da58a0c75339d389ba959cbef22a6694732 /libavcodec/mobiclip.c | |
| parent | a207df2acb92d6366ab2f0f18ba35709066b8eec (diff) | |
avcodec/mobiclip: Check mv against INT_MAX
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 27369/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-5083469356728320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/mobiclip.c')
| -rw-r--r-- | libavcodec/mobiclip.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/mobiclip.c b/libavcodec/mobiclip.c index 42d33cf6a5..3c2df80896 100644 --- a/libavcodec/mobiclip.c +++ b/libavcodec/mobiclip.c @@ -1146,6 +1146,8 @@ static int predict_motion(AVCodecContext *avctx, mv.x = mv.x + get_se_golomb(gb); mv.y = mv.y + get_se_golomb(gb); } + if (mv.x >= INT_MAX || mv.y >= INT_MAX) + return AVERROR_INVALIDDATA; motion[offsetm].x = mv.x; motion[offsetm].y = mv.y; |