Caught by ubsan - would cause an invalid shift in constructing the run value.
Unified · Split
| @@ -278,6 +278,13 @@ int ff_apv_entropy_decode_block(int16_t *restrict coeff, · 277 unmodified lines | |||
| 278 | bits = next_bits & 0xffff; | 278 | bits = next_bits & 0xffff; |
| 279 | // Determine code length. | 279 | // Determine code length. |
| 280 | leading_zeroes = 15 - av_log2(bits); | 280 | leading_zeroes = 15 - av_log2(bits); |
| 281 | if (leading_zeroes >= 6) { | ||
| 282 | // 6 zeroes implies run > 64, which is always invalid. | ||
| 283 | av_log(state->log_ctx, AV_LOG_ERROR, | ||
| 284 | "Out-of-range run value: %d leading zeroes.\n", | ||
| 285 | leading_zeroes); | ||
| 286 | return AVERROR_INVALIDDATA; | ||
| 287 | } | ||
| 281 | // Extract the low bits. | 288 | // Extract the low bits. |
| 282 | low_bit_count = leading_zeroes; | 289 | low_bit_count = leading_zeroes; |
| 283 | low_bit_shift = 16 - (1 + 2 * leading_zeroes); | 290 | low_bit_shift = 16 - (1 + 2 * leading_zeroes); |
| @@ -443,6 +450,13 @@ int ff_apv_entropy_decode_block(int16_t *restrict coeff, · 159 unmodified lines | |||
| 443 | bits = next_bits & 0xffff; | 450 | bits = next_bits & 0xffff; |
| 444 | // Determine code length. | 451 | // Determine code length. |
| 445 | leading_zeroes = 15 - av_log2(bits); | 452 | leading_zeroes = 15 - av_log2(bits); |
| 453 | if (leading_zeroes >= 6) { | ||
| 454 | // 6 zeroes implies run > 64, which is always invalid. | ||
| 455 | av_log(state->log_ctx, AV_LOG_ERROR, | ||
| 456 | "Out-of-range run value: %d leading zeroes.\n", | ||
| 457 | leading_zeroes); | ||
| 458 | return AVERROR_INVALIDDATA; | ||
| 459 | } | ||
| 446 | // Extract the low bits. | 460 | // Extract the low bits. |
| 447 | low_bit_count = leading_zeroes + k_run; | 461 | low_bit_count = leading_zeroes + k_run; |
| 448 | low_bit_shift = 16 - (1 + 2 * leading_zeroes + k_run); | 462 | low_bit_shift = 16 - (1 + 2 * leading_zeroes + k_run); |