Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int' Fixes: 65909/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMIX_fuzzer-519459745831321
Unified · Split
| @@ -235,6 +235,9 @@ static int decode_frame(AVCodecContext *avctx, · 234 unmodified lines | ||
| 235 | 235 | else if (offset != 3) |
| 236 | 236 | return AVERROR_INVALIDDATA; |
| 237 | 237 | |
| 238 | + if (s->lshift > 31) | |
| 239 | + return AVERROR_INVALIDDATA; | |
| 240 | + | |
| 238 | 241 | q = quality[FFMIN(avpkt->data[offset - 2], FF_ARRAY_ELEMS(quality)-1)]; |
| 239 | 242 | for (int n = 0; n < 64; n++) |
| 240 | 243 | s->factors[n] = quant[n] * q; |