[FFmpeg-devel] [PATCH 1/3] avcodec/g2meet: Check RGB upper limit

[Michael Niedermayer]

On Fri, Apr 27, 2018 at 09:44:05PM +0200, Michael Niedermayer wrote:
> Fixes: runtime error: left shift of 1876744317 by 16 places cannot be represented in type 'int'
> Fixes: 6799/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5115274731716608
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/g2meet.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c
> index b409dae813..105a40278f 100644
> --- a/libavcodec/g2meet.c
> +++ b/libavcodec/g2meet.c
> @@ -556,7 +556,7 @@ static uint32_t epic_decode_pixel_pred(ePICContext *dc, int x, int y,
>          B     = ((pred >> B_shift) & 0xFF) - TOSIGNED(delta);
>      }
>  
> -    if (R<0 || G<0 || B<0) {
> +    if (R<0 || G<0 || B<0 || R > 255 || G > 255 || B > 255) {
>          av_log(NULL, AV_LOG_ERROR, "RGB %d %d %d is out of range\n", R, G, B);
>          return 0;

i saw someone asked why this doesnt clip on the IRC backlog

There is AFAIK no public spec so theres nothing really solid to base a 
preferrance on.

I favor a hard error as it is easier t debug in case it misbehaves.
silently cliping (if its wrong) leads to more difficult to trace issues.

But if people prefer i can change it to clip of course.

Thanks

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

He who knows, does not speak. He who speaks, does not know. -- Lao Tsu
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: not available
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20180429/da98c5d1/attachment.sig>