avcodec/dirac_vlc: limit res_bits in APPEND_RESIDUE()
authorMichael Niedermayer <michael@niedermayer.cc>
Sat, 9 Sep 2017 13:51:45 +0000 (15:51 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Sat, 9 Sep 2017 16:55:47 +0000 (18:55 +0200)
Fixes: runtime error: left shift of 1073741838 by 1 places cannot be represented in type 'int32_t' (aka 'int')
Fixes: 3279/clusterfuzz-testcase-minimized-4564805744590848

Suggested-by: <atomnuker>
Reviewed-by: <atomnuker>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/dirac_vlc.c

index bd37f31..496d817 100644 (file)
@@ -37,7 +37,7 @@
 
 #define APPEND_RESIDUE(N, M)                                                   \
     N          |= M >> (N ## _bits);                                           \
-    N ## _bits +=      (M ## _bits)
+    N ## _bits  = (N ## _bits + (M ## _bits)) & 0x3F
 
 int ff_dirac_golomb_read_32bit(DiracGolombLUT *lut_ctx, const uint8_t *buf,
                                int bytes, uint8_t *_dst, int coeffs)
@@ -56,9 +56,6 @@ int ff_dirac_golomb_read_32bit(DiracGolombLUT *lut_ctx, const uint8_t *buf,
         if ((c_idx + 1) > coeffs)
             return c_idx;
 
-        if (res_bits >= RSIZE_BITS)
-            res_bits = res = 0;
-
         /* res_bits is a hint for better branch prediction */
         if (res_bits && l->sign) {
             int32_t coeff = 1;
@@ -99,9 +96,6 @@ int ff_dirac_golomb_read_16bit(DiracGolombLUT *lut_ctx, const uint8_t *buf,
         if ((c_idx + 1) > coeffs)
             return c_idx;
 
-        if (res_bits >= RSIZE_BITS)
-            res_bits = res = 0;
-
         if (res_bits && l->sign) {
             int32_t coeff = 1;
             APPEND_RESIDUE(res, l->preamble);