avcodec/proresdec2: SKIP_BITS() does not work with len=32
authorMichael Niedermayer <michael@niedermayer.cc>
Mon, 2 Oct 2017 02:18:22 +0000 (04:18 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Thu, 26 Oct 2017 15:34:42 +0000 (17:34 +0200)
Fixes: invalid shift
Fixes: 3482/clusterfuzz-testcase-minimized-5446915875405824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c37138e01a93da2f9dd2cc5d4b77e5a38581d130)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/proresdec2.c

index 779ae6a..fe5fddc 100644 (file)
@@ -267,7 +267,7 @@ static int decode_picture_header(AVCodecContext *avctx, const uint8_t *buf, cons
                                                                         \
         if (q > switch_bits) { /* exp golomb */                         \
             bits = exp_order - switch_bits + (q<<1);                    \
-            if (bits > MIN_CACHE_BITS)                                  \
+            if (bits > FFMIN(MIN_CACHE_BITS, 31))                       \
                 return AVERROR_INVALIDDATA;                             \
             val = SHOW_UBITS(re, gb, bits) - (1 << exp_order) +         \
                 ((switch_bits + 1) << rice_order);                      \