Fixes: signed integer overflow: 15 + 2147483646 cannot be represented in type 'int' Fixes: 8381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-6225533137321984
Unified · Split
| @@ -261,10 +261,16 @@ static int decode_unregistered_user_data(H264SEIUnregistered *h, GetBitContext * · 260 unmodified lines | ||
| 261 | 261 | return 0; |
| 262 | 262 | } |
| 263 | 263 | |
| 264 | −static int decode_recovery_point(H264SEIRecoveryPoint *h, GetBitContext *gb) | |
| 264 | +static int decode_recovery_point(H264SEIRecoveryPoint *h, GetBitContext *gb, void *logctx) | |
| 265 | 265 | { |
| 266 | − h->recovery_frame_cnt = get_ue_golomb_long(gb); | |
| 266 | + unsigned recovery_frame_cnt = get_ue_golomb_long(gb); | |
| 267 | 267 | |
| 268 | + if (recovery_frame_cnt >= (1<<MAX_LOG2_MAX_FRAME_NUM)) { | |
| 269 | + av_log(logctx, AV_LOG_ERROR, "recovery_frame_cnt %u is out of range\n", recovery_frame_cnt); | |
| 270 | + return AVERROR_INVALIDDATA; | |
| 271 | + } | |
| 272 | + | |
| 273 | + h->recovery_frame_cnt = recovery_frame_cnt; | |
| 268 | 274 | /* 1b exact_match_flag, |
| 269 | 275 | * 1b broken_link_flag, |
| 270 | 276 | * 2b changing_slice_group_idc */ |
| @@ -429,7 +435,7 @@ int ff_h264_sei_decode(H264SEIContext *h, GetBitContext *gb, · 158 unmodified lines | ||
| 429 | 435 | ret = decode_unregistered_user_data(&h->unregistered, gb, logctx, size); |
| 430 | 436 | break; |
| 431 | 437 | case H264_SEI_TYPE_RECOVERY_POINT: |
| 432 | − ret = decode_recovery_point(&h->recovery_point, gb); | |
| 438 | + ret = decode_recovery_point(&h->recovery_point, gb, logctx); | |
| 433 | 439 | break; |
| 434 | 440 | case H264_SEI_TYPE_BUFFERING_PERIOD: |
| 435 | 441 | ret = decode_buffering_period(&h->buffering_period, gb, ps, logctx); |