Commit 5eb04570 authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/wavpack: Check post_shift

Fixes: runtime error: shift exponent 34 is too large for 32-bit type 'int'

Fixes: 653/clusterfuzz-testcase-5773837415219200
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent dbc7f02a
...@@ -681,6 +681,9 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no, ...@@ -681,6 +681,9 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no,
s->hybrid = s->frame_flags & WV_HYBRID_MODE; s->hybrid = s->frame_flags & WV_HYBRID_MODE;
s->hybrid_bitrate = s->frame_flags & WV_HYBRID_BITRATE; s->hybrid_bitrate = s->frame_flags & WV_HYBRID_BITRATE;
s->post_shift = bpp * 8 - orig_bpp + ((s->frame_flags >> 13) & 0x1f); s->post_shift = bpp * 8 - orig_bpp + ((s->frame_flags >> 13) & 0x1f);
if (s->post_shift < 0 || s->post_shift > 31) {
return AVERROR_INVALIDDATA;
}
s->hybrid_maxclip = ((1LL << (orig_bpp - 1)) - 1); s->hybrid_maxclip = ((1LL << (orig_bpp - 1)) - 1);
s->hybrid_minclip = ((-1UL << (orig_bpp - 1))); s->hybrid_minclip = ((-1UL << (orig_bpp - 1)));
s->CRC = bytestream2_get_le32(&gb); s->CRC = bytestream2_get_le32(&gb);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment