avcodec/alsdec: Check for block_length <= 0 in read_var_block_data()
authorMichael Niedermayer <michael@niedermayer.cc>
Fri, 26 Jul 2019 13:26:08 +0000 (15:26 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Mon, 5 Aug 2019 16:44:34 +0000 (18:44 +0200)
Fixes: left shift of negative value -1
Fixes: 15719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5685731105701888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/alsdec.c

index 6b57741..d445148 100644 (file)
@@ -657,7 +657,7 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
 
     // do not continue in case of a damaged stream since
     // block_length must be evenly divisible by sub_blocks
-    if (bd->block_length & (sub_blocks - 1)) {
+    if (bd->block_length & (sub_blocks - 1) || bd->block_length <= 0) {
         av_log(avctx, AV_LOG_WARNING,
                "Block length is not evenly divisible by the number of subblocks.\n");
         return AVERROR_INVALIDDATA;