Commit 2169a3f2 authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/agm: Fix integer overflow with w/h

Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 13999/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5644405991538688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by: 's avatarPaul B Mahol <onemda@gmail.com>
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 18a851ac
...@@ -535,11 +535,13 @@ static int decode_frame(AVCodecContext *avctx, void *data, ...@@ -535,11 +535,13 @@ static int decode_frame(AVCodecContext *avctx, void *data,
s->flags = 0; s->flags = 0;
w = bytestream2_get_le32(gbyte); w = bytestream2_get_le32(gbyte);
h = bytestream2_get_le32(gbyte);
if (w == INT32_MIN || h == INT32_MIN)
return AVERROR_INVALIDDATA;
if (w < 0) { if (w < 0) {
w = -w; w = -w;
s->flags |= 2; s->flags |= 2;
} }
h = bytestream2_get_le32(gbyte);
if (h < 0) { if (h < 0) {
h = -h; h = -h;
s->flags |= 1; s->flags |= 1;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment