shithub: dav1d

Info  •  Files  •  Log  •  Branches

fix unwanted integer promotion in tile data size parsing.

Fixes an undefined left shift in
clusterfuzz-testcase-minimized-dav1d_fuzzer-5717082881130496. Credits to
oss-fuzz. Fixes #110

--- a/src/decode.c

+++ b/src/decode.c

@@ -2608,7 +2608,7 @@

                 if (f->frame_hdr.tiling.n_bytes > size) goto error;

                 tile_sz = 0;

                 for (unsigned k = 0; k < f->frame_hdr.tiling.n_bytes; k++)

-                    tile_sz |= *data++ << (k * 8);

+                    tile_sz |= (unsigned)*data++ << (k * 8);

                 tile_sz++;

                 size -= f->frame_hdr.tiling.n_bytes;

                 if (tile_sz > size) goto error;