Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int' Fixes: 65909/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMIX_fuzzer-519459745831321
Unified · Split
| @@ -235,6 +235,9 @@ static int decode_frame(AVCodecContext *avctx, · 234 unmodified lines | |||
| 235 | else if (offset != 3) | 235 | else if (offset != 3) |
| 236 | return AVERROR_INVALIDDATA; | 236 | return AVERROR_INVALIDDATA; |
| 237 | 237 | ||
| 238 | if (s->lshift > 31) | ||
| 239 | return AVERROR_INVALIDDATA; | ||
| 240 | |||
| 238 | q = quality[FFMIN(avpkt->data[offset - 2], FF_ARRAY_ELEMS(quality)-1)]; | 241 | q = quality[FFMIN(avpkt->data[offset - 2], FF_ARRAY_ELEMS(quality)-1)]; |
| 239 | for (int n = 0; n < 64; n++) | 242 | for (int n = 0; n < 64; n++) |
| 240 | s->factors[n] = quant[n] * q; | 243 | s->factors[n] = quant[n] * q; |