oss-fuzz: UndefinedBehaviorSanitizer: undefined-shift in dav1d_decode_frame() src/decode.c
Build with -fsanitize=shift
reproduce with ./tests/dav1d_fuzzer clusterfuzz-testcase-minimized-dav1d_fuzzer-5717082881130496
clusterfuzz-testcase-minimized-dav1d_fuzzer-5717082881130496
tested with commit 128715b5
src/decode.c:2607:40: runtime error: left shift of 179 by 24 places cannot be represented in type 'int'
#0 0x4754f8 in dav1d_decode_frame src/decode.c:2607:40
#1 0x477779 in dav1d_submit_frame src/decode.c:3036:20
#2 0x469326 in dav1d_parse_obus src/obu.c:1106:20
#3 0x467688 in dav1d_decode src/lib.c:201:20
#4 0x465808 in LLVMFuzzerTestOneInput tests/libfuzzer/dav1d_fuzzer.c:82:19
#5 0x4407b8 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:570:15
#6 0x43104d in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
#7 0x434f7b in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
#8 0x430d38 in main /src/libfuzzer/FuzzerMain.cpp:20:10
#9 0x7f1f28d3882f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
Edited by Tyson Smith