Fixes: libavcodec/put_bits.h:232:32: runtime error: shift exponent -19 is negative Fixes: Assertion n>=0 && n<=32 failed at ./libavcodec/get_bits.h:406 Fixes: 398527871/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6602025714647040
Unified · Split
| @@ -288,7 +288,7 @@ static int update_extradata(AVCodecParameters *codecpar) · 287 unmodified lines | ||
| 288 | 288 | uint8_t buf[6]; |
| 289 | 289 | int size = FFMIN(codecpar->extradata_size, sizeof(buf)); |
| 290 | 290 | |
| 291 | − init_put_bits(&pb, buf, size); | |
| 291 | + init_put_bits(&pb, buf, sizeof(buf)); | |
| 292 | 292 | ret = init_get_bits8(&gb, codecpar->extradata, size); |
| 293 | 293 | if (ret < 0) |
| 294 | 294 | return ret; |
| @@ -304,7 +304,10 @@ static int update_extradata(AVCodecParameters *codecpar) · 9 unmodified lines | ||
| 304 | 304 | |
| 305 | 305 | skip_bits(&gb, 4); |
| 306 | 306 | put_bits(&pb, 4, codecpar->ch_layout.nb_channels); // set channel config |
| 307 | − ret = put_bits_left(&pb); | |
| 307 | + ret = get_bits_left(&gb); | |
| 308 | + if (ret < 0) | |
| 309 | + return AVERROR_INVALIDDATA; | |
| 310 | + ret = FFMIN(ret, put_bits_left(&pb)); | |
| 308 | 311 | while (ret >= 32) { |
| 309 | 312 | put_bits32(&pb, get_bits_long(&gb, 32)); |
| 310 | 313 | ret -= 32; |
| @@ -317,9 +320,10 @@ static int update_extradata(AVCodecParameters *codecpar) · 6 unmodified lines | ||
| 317 | 320 | } |
| 318 | 321 | case AV_CODEC_ID_FLAC: { |
| 319 | 322 | uint8_t buf[13]; |
| 323 | + int size = FFMIN(codecpar->extradata_size, sizeof(buf)); | |
| 320 | 324 | |
| 321 | 325 | init_put_bits(&pb, buf, sizeof(buf)); |
| 322 | − ret = init_get_bits8(&gb, codecpar->extradata, codecpar->extradata_size); | |
| 326 | + ret = init_get_bits8(&gb, codecpar->extradata, size); | |
| 323 | 327 | if (ret < 0) |
| 324 | 328 | return ret; |
| 325 | 329 | |
| @@ -328,11 +332,14 @@ static int update_extradata(AVCodecParameters *codecpar) · 2 unmodified lines | ||
| 328 | 332 | put_bits(&pb, 20, get_bits(&gb, 20)); // samplerate |
| 329 | 333 | skip_bits(&gb, 3); |
| 330 | 334 | put_bits(&pb, 3, codecpar->ch_layout.nb_channels - 1); |
| 331 | − ret = put_bits_left(&pb); | |
| 335 | + ret = get_bits_left(&gb); | |
| 336 | + if (ret < 0) | |
| 337 | + return AVERROR_INVALIDDATA; | |
| 338 | + ret = FFMIN(ret, put_bits_left(&pb)); | |
| 332 | 339 | put_bits(&pb, ret, get_bits(&gb, ret)); |
| 333 | 340 | flush_put_bits(&pb); |
| 334 | 341 | |
| 335 | − memcpy(codecpar->extradata, buf, sizeof(buf)); | |
| 342 | + memcpy(codecpar->extradata, buf, put_bytes_output(&pb)); | |
| 336 | 343 | break; |
| 337 | 344 | } |
| 338 | 345 | } |