Commit 62d10ec3 authored by Michael Niedermayer's avatar Michael Niedermayer

avformat/vividas: Fixes overflow in shift in recover_key()

Fixes: left shift of 133 by 24 places cannot be represented in type 'int'
Fixes: 15365/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5716153105645568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSuggested-by: 's avatarReimar Döffinger <Reimar.Doeffinger@gmx.de>
Reviewed-by: 's avatarReimar Döffinger <Reimar.Doeffinger@gmx.de>
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 84669b18
...@@ -115,10 +115,7 @@ static unsigned recover_key(unsigned char sample[4], unsigned expected_size) ...@@ -115,10 +115,7 @@ static unsigned recover_key(unsigned char sample[4], unsigned expected_size)
put_v(plaintext+2, expected_size); put_v(plaintext+2, expected_size);
return (sample[0]^plaintext[0])| return AV_RL32(sample) ^ AV_RL32(plaintext);
((sample[1]^plaintext[1])<<8)|
((sample[2]^plaintext[2])<<16)|
((sample[3]^plaintext[3])<<24);
} }
static void xor_block(void *p1, void *p2, unsigned size, int key, unsigned *key_ptr) static void xor_block(void *p1, void *p2, unsigned size, int key, unsigned *key_ptr)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment