The limit is based on later code storing 32bits Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int' Fixes: 393164866/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-4606798354513920
Unified · Split
| @@ -62,7 +62,7 @@ static void parse_qn(GetBitContext *gb, int *qn, int nk_mode, int no_qn) · 61 unmodified lines | ||
| 62 | 62 | { |
| 63 | 63 | if (nk_mode == 1) { |
| 64 | 64 | for (int k = 0; k < no_qn; k++) { |
| 65 | − qn[k] = get_unary(gb, 0, INT32_MAX); // TODO: find proper ranges | |
| 65 | + qn[k] = get_unary(gb, 0, 68); // TODO: find proper ranges | |
| 66 | 66 | if (qn[k]) |
| 67 | 67 | qn[k]++; |
| 68 | 68 | } |
| @@ -75,7 +75,7 @@ static void parse_qn(GetBitContext *gb, int *qn, int nk_mode, int no_qn) · 6 unmodified lines | ||
| 75 | 75 | if (nk_mode == 2) { |
| 76 | 76 | for (int k = 0; k < no_qn; k++) { |
| 77 | 77 | if (qn[k] > 4) { |
| 78 | − qn[k] = get_unary(gb, 0, INT32_MAX);; | |
| 78 | + qn[k] = get_unary(gb, 0, 65); | |
| 79 | 79 | if (qn[k]) |
| 80 | 80 | qn[k] += 4; |
| 81 | 81 | } |
| @@ -85,7 +85,7 @@ static void parse_qn(GetBitContext *gb, int *qn, int nk_mode, int no_qn) · 3 unmodified lines | ||
| 85 | 85 | |
| 86 | 86 | for (int k = 0; k < no_qn; k++) { |
| 87 | 87 | if (qn[k] > 4) { |
| 88 | − int qn_ext = get_unary(gb, 0, INT32_MAX);; | |
| 88 | + int qn_ext = get_unary(gb, 0, 65); | |
| 89 | 89 | switch (qn_ext) { |
| 90 | 90 | case 0: qn[k] = 5; break; |
| 91 | 91 | case 1: qn[k] = 6; break; |
| @@ -114,6 +114,9 @@ static int parse_codebook_idx(GetBitContext *gb, uint32_t *kv, · 22 unmodified lines | ||
| 114 | 114 | } |
| 115 | 115 | } |
| 116 | 116 | |
| 117 | + if (nk > 25) | |
| 118 | + return AVERROR_PATCHWELCOME; | |
| 119 | + | |
| 117 | 120 | skip_bits(gb, 4*n); |
| 118 | 121 | |
| 119 | 122 | if (nk > 0) |