Caught by ubsan - would cause an invalid shift in constructing the run value.
Unified · Split
| @@ -278,6 +278,13 @@ int ff_apv_entropy_decode_block(int16_t *restrict coeff, · 277 unmodified lines | ||
| 278 | 278 | bits = next_bits & 0xffff; |
| 279 | 279 | // Determine code length. |
| 280 | 280 | leading_zeroes = 15 - av_log2(bits); |
| 281 | + if (leading_zeroes >= 6) { | |
| 282 | + // 6 zeroes implies run > 64, which is always invalid. | |
| 283 | + av_log(state->log_ctx, AV_LOG_ERROR, | |
| 284 | + "Out-of-range run value: %d leading zeroes.\n", | |
| 285 | + leading_zeroes); | |
| 286 | + return AVERROR_INVALIDDATA; | |
| 287 | + } | |
| 281 | 288 | // Extract the low bits. |
| 282 | 289 | low_bit_count = leading_zeroes; |
| 283 | 290 | low_bit_shift = 16 - (1 + 2 * leading_zeroes); |
| @@ -443,6 +450,13 @@ int ff_apv_entropy_decode_block(int16_t *restrict coeff, · 159 unmodified lines | ||
| 443 | 450 | bits = next_bits & 0xffff; |
| 444 | 451 | // Determine code length. |
| 445 | 452 | leading_zeroes = 15 - av_log2(bits); |
| 453 | + if (leading_zeroes >= 6) { | |
| 454 | + // 6 zeroes implies run > 64, which is always invalid. | |
| 455 | + av_log(state->log_ctx, AV_LOG_ERROR, | |
| 456 | + "Out-of-range run value: %d leading zeroes.\n", | |
| 457 | + leading_zeroes); | |
| 458 | + return AVERROR_INVALIDDATA; | |
| 459 | + } | |
| 446 | 460 | // Extract the low bits. |
| 447 | 461 | low_bit_count = leading_zeroes + k_run; |
| 448 | 462 | low_bit_shift = 16 - (1 + 2 * leading_zeroes + k_run); |