avcodec/h264_slice: Fix signed integer overflow
authorMichael Niedermayer <michael@niedermayer.cc>
Tue, 4 Jul 2017 22:05:11 +0000 (00:05 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Wed, 5 Jul 2017 01:19:27 +0000 (03:19 +0200)
Fixes: runtime error: signed integer overflow: 26 + 2147483644 cannot be represented in type 'int'
Fixes: 2456/clusterfuzz-testcase-minimized-4822695051001856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/h264_slice.c

index faa684c..6deb08f 100644 (file)
@@ -1825,7 +1825,7 @@ static int h264_slice_header_parse(const H264Context *h, H264SliceContext *sl,
     }
 
     sl->last_qscale_diff = 0;
-    tmp = pps->init_qp + get_se_golomb(&sl->gb);
+    tmp = pps->init_qp + (unsigned)get_se_golomb(&sl->gb);
     if (tmp > 51 + 6 * (sps->bit_depth_luma - 8)) {
         av_log(h->avctx, AV_LOG_ERROR, "QP %u out of range\n", tmp);
         return AVERROR_INVALIDDATA;