Fixes: integer overflow Fixes: 418314174/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-4871731867353088
Showing the changes to libavcodec (1 of 1 file). Show all
Unified · Split
| @@ -2053,6 +2053,8 @@ static int palette_subblock_data(VVCLocalContext *lc, · 2052 unmodified lines | ||
| 2053 | 2053 | const int v = PALETTE_INDEX(xc, yc); |
| 2054 | 2054 | if (v == esc) { |
| 2055 | 2055 | const int coeff = ff_vvc_palette_escape_val(lc); |
| 2056 | + if (coeff >= (1U << sps->bit_depth)) | |
| 2057 | + return AVERROR_INVALIDDATA; | |
| 2056 | 2058 | const int pixel = av_clip_intp2(RSHIFT(coeff * scale, 6), sps->bit_depth); |
| 2057 | 2059 | PALETTE_SET_PIXEL(xc, yc, pixel); |
| 2058 | 2060 | } else { |