Fixes: libavcodec/put_bits.h:232:32: runtime error: shift exponent -19 is negative Fixes: Assertion n>=0 && n<=32 failed at ./libavcodec/get_bits.h:406 Fixes: 398527871/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6602025714647040
Unified · Split
| @@ -288,7 +288,7 @@ static int update_extradata(AVCodecParameters *codecpar) · 287 unmodified lines | |||
| 288 | uint8_t buf[6]; | 288 | uint8_t buf[6]; |
| 289 | int size = FFMIN(codecpar->extradata_size, sizeof(buf)); | 289 | int size = FFMIN(codecpar->extradata_size, sizeof(buf)); |
| 290 | 290 | ||
| 291 | init_put_bits(&pb, buf, size); | 291 | init_put_bits(&pb, buf, sizeof(buf)); |
| 292 | ret = init_get_bits8(&gb, codecpar->extradata, size); | 292 | ret = init_get_bits8(&gb, codecpar->extradata, size); |
| 293 | if (ret < 0) | 293 | if (ret < 0) |
| 294 | return ret; | 294 | return ret; |
| @@ -304,7 +304,10 @@ static int update_extradata(AVCodecParameters *codecpar) · 9 unmodified lines | |||
| 304 | 304 | ||
| 305 | skip_bits(&gb, 4); | 305 | skip_bits(&gb, 4); |
| 306 | put_bits(&pb, 4, codecpar->ch_layout.nb_channels); // set channel config | 306 | put_bits(&pb, 4, codecpar->ch_layout.nb_channels); // set channel config |
| 307 | ret = put_bits_left(&pb); | 307 | ret = get_bits_left(&gb); |
| 308 | if (ret < 0) | ||
| 309 | return AVERROR_INVALIDDATA; | ||
| 310 | ret = FFMIN(ret, put_bits_left(&pb)); | ||
| 308 | while (ret >= 32) { | 311 | while (ret >= 32) { |
| 309 | put_bits32(&pb, get_bits_long(&gb, 32)); | 312 | put_bits32(&pb, get_bits_long(&gb, 32)); |
| 310 | ret -= 32; | 313 | ret -= 32; |
| @@ -317,9 +320,10 @@ static int update_extradata(AVCodecParameters *codecpar) · 6 unmodified lines | |||
| 317 | } | 320 | } |
| 318 | case AV_CODEC_ID_FLAC: { | 321 | case AV_CODEC_ID_FLAC: { |
| 319 | uint8_t buf[13]; | 322 | uint8_t buf[13]; |
| 323 | int size = FFMIN(codecpar->extradata_size, sizeof(buf)); | ||
| 320 | 324 | ||
| 321 | init_put_bits(&pb, buf, sizeof(buf)); | 325 | init_put_bits(&pb, buf, sizeof(buf)); |
| 322 | ret = init_get_bits8(&gb, codecpar->extradata, codecpar->extradata_size); | 326 | ret = init_get_bits8(&gb, codecpar->extradata, size); |
| 323 | if (ret < 0) | 327 | if (ret < 0) |
| 324 | return ret; | 328 | return ret; |
| 325 | 329 | ||
| @@ -328,11 +332,14 @@ static int update_extradata(AVCodecParameters *codecpar) · 2 unmodified lines | |||
| 328 | put_bits(&pb, 20, get_bits(&gb, 20)); // samplerate | 332 | put_bits(&pb, 20, get_bits(&gb, 20)); // samplerate |
| 329 | skip_bits(&gb, 3); | 333 | skip_bits(&gb, 3); |
| 330 | put_bits(&pb, 3, codecpar->ch_layout.nb_channels - 1); | 334 | put_bits(&pb, 3, codecpar->ch_layout.nb_channels - 1); |
| 331 | ret = put_bits_left(&pb); | 335 | ret = get_bits_left(&gb); |
| 336 | if (ret < 0) | ||
| 337 | return AVERROR_INVALIDDATA; | ||
| 338 | ret = FFMIN(ret, put_bits_left(&pb)); | ||
| 332 | put_bits(&pb, ret, get_bits(&gb, ret)); | 339 | put_bits(&pb, ret, get_bits(&gb, ret)); |
| 333 | flush_put_bits(&pb); | 340 | flush_put_bits(&pb); |
| 334 | 341 | ||
| 335 | memcpy(codecpar->extradata, buf, sizeof(buf)); | 342 | memcpy(codecpar->extradata, buf, put_bytes_output(&pb)); |
| 336 | break; | 343 | break; |
| 337 | } | 344 | } |
| 338 | } | 345 | } |