Fixes: integer overflow Fixes: 2893/clusterfuzz-testcase-minimized-5809330567774208
Unified · Split
| @@ -225,6 +225,12 @@ int ff_hevc_decode_short_term_rps(GetBitContext *gb, AVCodecContext *avctx, · 224 unmodified lines | ||
| 225 | 225 | prev = 0; |
| 226 | 226 | for (i = 0; i < rps->num_negative_pics; i++) { |
| 227 | 227 | delta_poc = get_ue_golomb_long(gb) + 1; |
| 228 | + if (delta_poc < 1 || delta_poc > 32768) { | |
| 229 | + av_log(avctx, AV_LOG_ERROR, | |
| 230 | + "Invalid value of delta_poc: %d\n", | |
| 231 | + delta_poc); | |
| 232 | + return AVERROR_INVALIDDATA; | |
| 233 | + } | |
| 228 | 234 | prev -= delta_poc; |
| 229 | 235 | rps->delta_poc[i] = prev; |
| 230 | 236 | rps->used[i] = get_bits1(gb); |
| @@ -232,6 +238,12 @@ int ff_hevc_decode_short_term_rps(GetBitContext *gb, AVCodecContext *avctx, · 1 unmodified line | ||
| 232 | 238 | prev = 0; |
| 233 | 239 | for (i = 0; i < nb_positive_pics; i++) { |
| 234 | 240 | delta_poc = get_ue_golomb_long(gb) + 1; |
| 241 | + if (delta_poc < 1 || delta_poc > 32768) { | |
| 242 | + av_log(avctx, AV_LOG_ERROR, | |
| 243 | + "Invalid value of delta_poc: %d\n", | |
| 244 | + delta_poc); | |
| 245 | + return AVERROR_INVALIDDATA; | |
| 246 | + } | |
| 235 | 247 | prev += delta_poc; |
| 236 | 248 | rps->delta_poc[rps->num_negative_pics + i] = prev; |
| 237 | 249 | rps->used[rps->num_negative_pics + i] = get_bits1(gb); |