Fixes: signed integer overflow: 15 + 2147483646 cannot be represented in type 'int' Fixes: 8381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-6225533137321984
Unified · Split
| @@ -261,10 +261,16 @@ static int decode_unregistered_user_data(H264SEIUnregistered *h, GetBitContext * · 260 unmodified lines | |||
| 261 | return 0; | 261 | return 0; |
| 262 | } | 262 | } |
| 263 | 263 | ||
| 264 | static int decode_recovery_point(H264SEIRecoveryPoint *h, GetBitContext *gb) | 264 | static int decode_recovery_point(H264SEIRecoveryPoint *h, GetBitContext *gb, void *logctx) |
| 265 | { | 265 | { |
| 266 | h->recovery_frame_cnt = get_ue_golomb_long(gb); | 266 | unsigned recovery_frame_cnt = get_ue_golomb_long(gb); |
| 267 | 267 | ||
| 268 | if (recovery_frame_cnt >= (1<<MAX_LOG2_MAX_FRAME_NUM)) { | ||
| 269 | av_log(logctx, AV_LOG_ERROR, "recovery_frame_cnt %u is out of range\n", recovery_frame_cnt); | ||
| 270 | return AVERROR_INVALIDDATA; | ||
| 271 | } | ||
| 272 | |||
| 273 | h->recovery_frame_cnt = recovery_frame_cnt; | ||
| 268 | /* 1b exact_match_flag, | 274 | /* 1b exact_match_flag, |
| 269 | * 1b broken_link_flag, | 275 | * 1b broken_link_flag, |
| 270 | * 2b changing_slice_group_idc */ | 276 | * 2b changing_slice_group_idc */ |
| @@ -429,7 +435,7 @@ int ff_h264_sei_decode(H264SEIContext *h, GetBitContext *gb, · 158 unmodified lines | |||
| 429 | ret = decode_unregistered_user_data(&h->unregistered, gb, logctx, size); | 435 | ret = decode_unregistered_user_data(&h->unregistered, gb, logctx, size); |
| 430 | break; | 436 | break; |
| 431 | case H264_SEI_TYPE_RECOVERY_POINT: | 437 | case H264_SEI_TYPE_RECOVERY_POINT: |
| 432 | ret = decode_recovery_point(&h->recovery_point, gb); | 438 | ret = decode_recovery_point(&h->recovery_point, gb, logctx); |
| 433 | break; | 439 | break; |
| 434 | case H264_SEI_TYPE_BUFFERING_PERIOD: | 440 | case H264_SEI_TYPE_BUFFERING_PERIOD: |
| 435 | ret = decode_buffering_period(&h->buffering_period, gb, ps, logctx); | 441 | ret = decode_buffering_period(&h->buffering_period, gb, ps, logctx); |