fenix
/
fdk-aac
mirror of https://github.com/mstorsjo/fdk-aac.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Add tighter sanity checks in CBlock_GetEscape 

We can't read 31 bits of value here, since that would place the
topmost bit in the sign bit.

Fixes: 3480/clusterfuzz-testcase-4573445423628288

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
This commit is contained in:
Martin Storsjo 2017-10-20 15:36:53 +03:00
parent 99c95ca3ea
commit 9b47a5e569
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libAACdec/src/block.cpp
View File

@ -143,7 +143,8 @@ LONG CBlock_GetEscape(HANDLE_FDK_BITSTREAM bs, /*!< pointer to bitstream */
if (FDKreadBit(bs) == 0) break; if (FDKreadBit(bs) == 0) break;
} }
if (i == 32) return (MAX_QUANTIZED_VALUE + 1); /* (1 << i) will shift into the sign bit if i >= 31 */
if (i >= 31) return (MAX_QUANTIZED_VALUE + 1);
off = FDKreadBits(bs, i); off = FDKreadBits(bs, i);
i = off + (1 << i); i = off + (1 << i);