The limit is based on later code storing 32bits Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int' Fixes: 393164866/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-4606798354513920
Unified · Split
| @@ -62,7 +62,7 @@ static void parse_qn(GetBitContext *gb, int *qn, int nk_mode, int no_qn) · 61 unmodified lines | |||
| 62 | { | 62 | { |
| 63 | if (nk_mode == 1) { | 63 | if (nk_mode == 1) { |
| 64 | for (int k = 0; k < no_qn; k++) { | 64 | for (int k = 0; k < no_qn; k++) { |
| 65 | qn[k] = get_unary(gb, 0, INT32_MAX); // TODO: find proper ranges | 65 | qn[k] = get_unary(gb, 0, 68); // TODO: find proper ranges |
| 66 | if (qn[k]) | 66 | if (qn[k]) |
| 67 | qn[k]++; | 67 | qn[k]++; |
| 68 | } | 68 | } |
| @@ -75,7 +75,7 @@ static void parse_qn(GetBitContext *gb, int *qn, int nk_mode, int no_qn) · 6 unmodified lines | |||
| 75 | if (nk_mode == 2) { | 75 | if (nk_mode == 2) { |
| 76 | for (int k = 0; k < no_qn; k++) { | 76 | for (int k = 0; k < no_qn; k++) { |
| 77 | if (qn[k] > 4) { | 77 | if (qn[k] > 4) { |
| 78 | qn[k] = get_unary(gb, 0, INT32_MAX);; | 78 | qn[k] = get_unary(gb, 0, 65); |
| 79 | if (qn[k]) | 79 | if (qn[k]) |
| 80 | qn[k] += 4; | 80 | qn[k] += 4; |
| 81 | } | 81 | } |
| @@ -85,7 +85,7 @@ static void parse_qn(GetBitContext *gb, int *qn, int nk_mode, int no_qn) · 3 unmodified lines | |||
| 85 | 85 | ||
| 86 | for (int k = 0; k < no_qn; k++) { | 86 | for (int k = 0; k < no_qn; k++) { |
| 87 | if (qn[k] > 4) { | 87 | if (qn[k] > 4) { |
| 88 | int qn_ext = get_unary(gb, 0, INT32_MAX);; | 88 | int qn_ext = get_unary(gb, 0, 65); |
| 89 | switch (qn_ext) { | 89 | switch (qn_ext) { |
| 90 | case 0: qn[k] = 5; break; | 90 | case 0: qn[k] = 5; break; |
| 91 | case 1: qn[k] = 6; break; | 91 | case 1: qn[k] = 6; break; |
| @@ -114,6 +114,9 @@ static int parse_codebook_idx(GetBitContext *gb, uint32_t *kv, · 22 unmodified lines | |||
| 114 | } | 114 | } |
| 115 | } | 115 | } |
| 116 | 116 | ||
| 117 | if (nk > 25) | ||
| 118 | return AVERROR_PATCHWELCOME; | ||
| 119 | |||
| 117 | skip_bits(gb, 4*n); | 120 | skip_bits(gb, 4*n); |
| 118 | 121 | ||
| 119 | if (nk > 0) | 122 | if (nk > 0) |