diff options
| author | Erik de Castro Lopo <erikd@mega-nerd.com> | 2019-11-24 14:14:50 +1100 |
|---|---|---|
| committer | Erik de Castro Lopo <erikd@mega-nerd.com> | 2019-11-24 19:30:34 +1100 |
| commit | b02e1593525f63aaa4c671e034ff8f0cdc641e46 (patch) | |
| tree | 3dea2c0ce6747abed47ee8fb972481f4f24c0b07 | |
| parent | d518e13a1f5802db84cc7986e94405042d247efb (diff) | |
| download | flac-b02e1593525f63aaa4c671e034ff8f0cdc641e46.tar.gz | |
libFLAC/bitreader.c: Fix shift invoking undefined behaviour
Credit: Oss-Fuzz
Issue: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19067
Testcase: fuzzer_decoder-5725157960450048
| -rw-r--r-- | src/libFLAC/bitreader.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/libFLAC/bitreader.c b/src/libFLAC/bitreader.c index e94f8b01..79cb5cc4 100644 --- a/src/libFLAC/bitreader.c +++ b/src/libFLAC/bitreader.c @@ -405,7 +405,8 @@ FLAC__bool FLAC__bitreader_read_raw_uint32(FLAC__BitReader *br, FLAC__uint32 *va const brword word = br->buffer[br->consumed_words]; const brword mask = br->consumed_bits < FLAC__BITS_PER_WORD ? FLAC__WORD_ALL_ONES >> br->consumed_bits : 0; if(bits < n) { - *val = (FLAC__uint32)((word & mask) >> (n-bits)); /* The result has <= 32 non-zero bits */ + uint32_t shift = n - bits; + *val = shift < FLAC__BITS_PER_WORD ? (FLAC__uint32)((word & mask) >> shift) : 0; /* The result has <= 32 non-zero bits */ br->consumed_bits += bits; return true; } @@ -670,7 +671,7 @@ FLAC__bool FLAC__bitreader_read_unary_unsigned(FLAC__BitReader *br, uint32_t *va *val = 0; while(1) { while(br->consumed_words < br->words) { /* if we've not consumed up to a partial tail word... */ - brword b = br->buffer[br->consumed_words] << br->consumed_bits; + brword b = br->consumed_bits < FLAC__BITS_PER_WORD ? br->buffer[br->consumed_words] << br->consumed_bits : 0; if(b) { i = COUNT_ZERO_MSBS(b); *val += i; |