diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-10-31 13:38:47 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-02-10 12:28:30 +0100 |
| commit | 3a24000e72fe3794ed51049b7a6e26f08e3e0b67 (patch) | |
| tree | 8d82898841c42cf455066c81d8731cd5026eb854 /libavcodec | |
| parent | a0ceb0cdd41b56241697cd8f83e22cdb4822d2d9 (diff) | |
avcodec/mobiclip: Bound planar prediction value
Fixes: signed integer overflow: 2 * 1073741952 cannot be represented in type 'int'
Fixes: 26765/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-6594926936326144
Fixes: 29663/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-5169789012148224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/mobiclip.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/mobiclip.c b/libavcodec/mobiclip.c index 94368c20e8..a15091426a 100644 --- a/libavcodec/mobiclip.c +++ b/libavcodec/mobiclip.c @@ -848,7 +848,7 @@ static int predict_intra(AVCodecContext *avctx, AVFrame *frame, int ax, int ay, uint8_t *left = frame->data[plane] + ay * frame->linesize[plane] + FFMAX(ax - 1, 0); int bottommost = frame->data[plane][(ay + size - 1) * frame->linesize[plane] + FFMAX(ax - 1, 0)]; int rightmost = frame->data[plane][FFMAX(ay - 1, 0) * frame->linesize[plane] + ax + size - 1]; - int avg = (bottommost + rightmost + 1) / 2 + 2 * get_se_golomb(gb); + int avg = (bottommost + rightmost + 1) / 2 + 2 * av_clip(get_se_golomb(gb), -(1<<16), 1<<16); int r6 = adjust(avg - bottommost, size); int r9 = adjust(avg - rightmost, size); int shift = adjust(size, size) == 8 ? 3 : 2; |