[vlc-commits] demux: avi: fix left shift ub

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Thu Jul 27 23:39:42 2017 +0200| [c592b1ff9258323f10d16185fef0ecb0726ee7e2] | committer: Francois Cartegnie

demux: avi: fix left shift ub

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=c592b1ff9258323f10d16185fef0ecb0726ee7e2
---

 modules/demux/avi/libavi.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/modules/demux/avi/libavi.c b/modules/demux/avi/libavi.c
index fc44f392e5..a18c1884ef 100644
--- a/modules/demux/avi/libavi.c
+++ b/modules/demux/avi/libavi.c
@@ -495,7 +495,12 @@ static int AVI_ChunkRead_strf( stream_t *s, avi_chunk_t *p_chk )
                         i_extrasize );
 
                 if ( !p_chk->strf.vids.p_bih->biClrUsed )
-                    p_chk->strf.vids.p_bih->biClrUsed = (1 << p_chk->strf.vids.p_bih->biBitCount);
+                {
+                    if( p_chk->strf.vids.p_bih->biBitCount < 32 )
+                        p_chk->strf.vids.p_bih->biClrUsed = (1 << p_chk->strf.vids.p_bih->biBitCount);
+                    else
+                        p_chk->strf.vids.p_bih->biBitCount = UINT16_MAX;
+                }
 
                 if( i_extrasize / sizeof(uint32_t) > UINT32_MAX )
                     p_chk->strf.vids.p_bih->biClrUsed = UINT32_MAX;