AuroraMiddleware/flac
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

libFLAC/bitreader.c: Fix shift invoking undefined behaviour

Browse Source 
Credit: Oss-Fuzz
Issue: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19067
Testcase: fuzzer_decoder-5725157960450048
This commit is contained in:
Erik de Castro Lopo 2019-11-24 14:14:50 +11:00
parent d518e13a1f
commit b02e159352
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/libFLAC/bitreader.c
View File

@ -405,7 +405,8 @@ FLAC__bool FLAC__bitreader_read_raw_uint32(FLAC__BitReader *br, FLAC__uint32 *va
const brword word = br->buffer[br->consumed_words]; const brword word = br->buffer[br->consumed_words];
const brword mask = br->consumed_bits < FLAC__BITS_PER_WORD ? FLAC__WORD_ALL_ONES >> br->consumed_bits : 0; const brword mask = br->consumed_bits < FLAC__BITS_PER_WORD ? FLAC__WORD_ALL_ONES >> br->consumed_bits : 0;
if(bits < n) { if(bits < n) {
*val = (FLAC__uint32)((word & mask) >> (n-bits)); /* The result has <= 32 non-zero bits */ uint32_t shift = n - bits;
*val = shift < FLAC__BITS_PER_WORD ? (FLAC__uint32)((word & mask) >> shift) : 0; /* The result has <= 32 non-zero bits */
br->consumed_bits += bits; br->consumed_bits += bits;
return true; return true;
} }
@ -670,7 +671,7 @@ FLAC__bool FLAC__bitreader_read_unary_unsigned(FLAC__BitReader *br, uint32_t *va
*val = 0; *val = 0;
while(1) { while(1) {
while(br->consumed_words < br->words) { /* if we've not consumed up to a partial tail word... */ while(br->consumed_words < br->words) { /* if we've not consumed up to a partial tail word... */
brword b = br->buffer[br->consumed_words] << br->consumed_bits; brword b = br->consumed_bits < FLAC__BITS_PER_WORD ? br->buffer[br->consumed_words] << br->consumed_bits : 0;
if(b) { if(b) {
i = COUNT_ZERO_MSBS(b); i = COUNT_ZERO_MSBS(b);
*val += i; *val += i;