Fixes: Assertion width > 0 && width <= 32 failed Fixes: 71012/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-6073354744823808
Unified · Split
| @@ -2307,6 +2307,12 @@ SEI_FUNC(sei_3d_reference_displays_info, (CodedBitstreamContext *ctx, RWContext · 2306 unmodified lines | ||
| 2307 | 2307 | else |
| 2308 | 2308 | length = FFMAX(0, (int)current->exponent_ref_display_width[i] + |
| 2309 | 2309 | (int)current->prec_ref_display_width - 31); |
| 2310 | + | |
| 2311 | + if (length > 32) { | |
| 2312 | + av_log(ctx->log_ctx, AV_LOG_ERROR, "refDispWidthBits > 32 is not supported\n"); | |
| 2313 | + return AVERROR_PATCHWELCOME; | |
| 2314 | + } | |
| 2315 | + | |
| 2310 | 2316 | if (length) |
| 2311 | 2317 | ubs(length, mantissa_ref_display_width[i], 1, i); |
| 2312 | 2318 | else |
| @@ -2318,6 +2324,12 @@ SEI_FUNC(sei_3d_reference_displays_info, (CodedBitstreamContext *ctx, RWContext · 5 unmodified lines | ||
| 2318 | 2324 | else |
| 2319 | 2325 | length = FFMAX(0, (int)current->exponent_ref_viewing_distance[i] + |
| 2320 | 2326 | (int)current->prec_ref_viewing_dist - 31); |
| 2327 | + | |
| 2328 | + if (length > 32) { | |
| 2329 | + av_log(ctx->log_ctx, AV_LOG_ERROR, "refViewDistBits > 32 is not supported\n"); | |
| 2330 | + return AVERROR_PATCHWELCOME; | |
| 2331 | + } | |
| 2332 | + | |
| 2321 | 2333 | if (length) |
| 2322 | 2334 | ubs(length, mantissa_ref_viewing_distance[i], 1, i); |
| 2323 | 2335 | else |