videolan
/
ffmpeg
mirror of https://git.videolan.org/git/ffmpeg.git
1
Fork 0
Code Releases Activity

avcodec/agm: Fix integer overflow with w/h 

Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 13999/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5644405991538688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-04-05 00:20:33 +02:00
parent 18a851aca7
commit 2169a3f262
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/agm.c
View File

@ -535,11 +535,13 @@ static int decode_frame(AVCodecContext *avctx, void *data,
s->flags = 0;
w = bytestream2_get_le32(gbyte);
h = bytestream2_get_le32(gbyte);
if (w == INT32_MIN || h == INT32_MIN)
return AVERROR_INVALIDDATA;
if (w < 0) {
w = -w;
s->flags |= 2;
}
h = bytestream2_get_le32(gbyte);
if (h < 0) {
h = -h;
s->flags |= 1;