LAV
/
FFmpeg
1
0
Fork 0
Code

avcodec/av1dec: Fix resolving zero divisor 

Fixes: Out of array read
Fixes: global-buffer-overflow-AV1

Found-by: "Leonelli, Matteo" <matteo.leonelli@cispa.de>
Tested-by: "Wang, Fei W" <fei.w.wang@intel.com>
Reviewed-by: "Wang, Fei W" <fei.w.wang@intel.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2023-11-30 02:36:41 +01:00
parent 4cdf2c7f76
commit 22daf2148f
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/av1dec.c
View File

@ -177,7 +177,7 @@ static uint8_t get_shear_params_valid(AV1DecContext *s, int idx)
int16_t alpha, beta, gamma, delta, divf, divs;
int64_t v, w;
int32_t *param = &s->cur_frame.gm_params[idx][0];
if (param[2] < 0)
if (param[2] <= 0)
return 0;
alpha = av_clip_int16(param[2] - (1 << AV1_WARPEDMODEL_PREC_BITS));