Fixes: signed integer overflow: 2 +
2147483646 cannot be represented in type 'int'
Fixes: 4792/clusterfuzz-testcase-minimized-
6322450775146496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit
eaa93175895568ef6c2542b13104874907d9c4ef)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
}
if (s->codeblock_mode && !(s->old_delta_quant && blockcnt_one)) {
- int quant = b->quant;
+ int quant;
if (is_arith)
- quant += dirac_get_arith_int(c, CTX_DELTA_Q_F, CTX_DELTA_Q_DATA);
+ quant = dirac_get_arith_int(c, CTX_DELTA_Q_F, CTX_DELTA_Q_DATA);
else
- quant += dirac_get_se_golomb(gb);
- if (quant < 0) {
+ quant = dirac_get_se_golomb(gb);
+ if (quant > INT_MAX - b->quant || b->quant + quant < 0) {
av_log(s->avctx, AV_LOG_ERROR, "Invalid quant\n");
return;
}
- b->quant = quant;
+ b->quant += quant;
}
if (b->quant > (DIRAC_MAX_QUANT_INDEX - 1)) {