Fixes: invalid shift Fixes: 37018/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG2VIDEO_fuzzer-5290280902328320
Unified · Split
| @@ -1538,6 +1538,10 @@ static int mpeg_decode_picture_coding_extension(Mpeg1Context *s1) · 1537 unmodified lines | ||
| 1538 | 1538 | s->mpeg_f_code[0][1] = get_bits(&s->gb, 4); |
| 1539 | 1539 | s->mpeg_f_code[1][0] = get_bits(&s->gb, 4); |
| 1540 | 1540 | s->mpeg_f_code[1][1] = get_bits(&s->gb, 4); |
| 1541 | + s->mpeg_f_code[0][0] += !s->mpeg_f_code[0][0]; | |
| 1542 | + s->mpeg_f_code[0][1] += !s->mpeg_f_code[0][1]; | |
| 1543 | + s->mpeg_f_code[1][0] += !s->mpeg_f_code[1][0]; | |
| 1544 | + s->mpeg_f_code[1][1] += !s->mpeg_f_code[1][1]; | |
| 1541 | 1545 | if (!s->pict_type && s1->mpeg_enc_ctx_allocated) { |
| 1542 | 1546 | av_log(s->avctx, AV_LOG_ERROR, "Missing picture start code\n"); |
| 1543 | 1547 | if (s->avctx->err_recognition & AV_EF_EXPLODE) |
| @@ -1553,10 +1557,6 @@ static int mpeg_decode_picture_coding_extension(Mpeg1Context *s1) · 9 unmodified lines | ||
| 1553 | 1557 | s->current_picture.f->pict_type = s->pict_type; |
| 1554 | 1558 | s->current_picture.f->key_frame = s->pict_type == AV_PICTURE_TYPE_I; |
| 1555 | 1559 | } |
| 1556 | − s->mpeg_f_code[0][0] += !s->mpeg_f_code[0][0]; | |
| 1557 | − s->mpeg_f_code[0][1] += !s->mpeg_f_code[0][1]; | |
| 1558 | − s->mpeg_f_code[1][0] += !s->mpeg_f_code[1][0]; | |
| 1559 | − s->mpeg_f_code[1][1] += !s->mpeg_f_code[1][1]; | |
| 1560 | 1560 | |
| 1561 | 1561 | s->intra_dc_precision = get_bits(&s->gb, 2); |
| 1562 | 1562 | s->picture_structure = get_bits(&s->gb, 2); |