avcodec/wavpack: Check post_shift
authorMichael Niedermayer <michael@niedermayer.cc>
Thu, 23 Feb 2017 14:19:29 +0000 (15:19 +0100)
committerMichael Niedermayer <michael@niedermayer.cc>
Sat, 25 Feb 2017 21:02:23 +0000 (22:02 +0100)
Fixes: runtime error: shift exponent 34 is too large for 32-bit type 'int'

Fixes: 653/clusterfuzz-testcase-5773837415219200

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/wavpack.c

index 24d57f5..eeee6a6 100644 (file)
@@ -681,6 +681,9 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no,
     s->hybrid         =   s->frame_flags & WV_HYBRID_MODE;
     s->hybrid_bitrate =   s->frame_flags & WV_HYBRID_BITRATE;
     s->post_shift     = bpp * 8 - orig_bpp + ((s->frame_flags >> 13) & 0x1f);
+    if (s->post_shift < 0 || s->post_shift > 31) {
+        return AVERROR_INVALIDDATA;
+    }
     s->hybrid_maxclip =  ((1LL << (orig_bpp - 1)) - 1);
     s->hybrid_minclip = ((-1UL << (orig_bpp - 1)));
     s->CRC            = bytestream2_get_le32(&gb);