diff --git a/modules/rtp_rtcp/source/rtp_depacketizer_av1.cc b/modules/rtp_rtcp/source/rtp_depacketizer_av1.cc index 45122dac48..52c62f87ab 100644 --- a/modules/rtp_rtcp/source/rtp_depacketizer_av1.cc +++ b/modules/rtp_rtcp/source/rtp_depacketizer_av1.cc @@ -311,7 +311,8 @@ bool CalculateObuSizes(ObuInfo* obu_info) { return false; } leb128_byte = *it; - obu_size_bytes |= (leb128_byte & 0x7F) << (size_of_obu_size_bytes * 7); + obu_size_bytes |= uint64_t{leb128_byte & 0x7Fu} + << (size_of_obu_size_bytes * 7); ++size_of_obu_size_bytes; ++it; } while ((leb128_byte & 0x80) != 0); diff --git a/test/fuzzers/BUILD.gn b/test/fuzzers/BUILD.gn index 7acbf023e2..7e81d56452 100644 --- a/test/fuzzers/BUILD.gn +++ b/test/fuzzers/BUILD.gn @@ -550,6 +550,7 @@ webrtc_fuzzer_test("rtp_depacketizer_av1_assemble_frame_fuzzer") { sources = [ "rtp_depacketizer_av1_assemble_frame_fuzzer.cc", ] + seed_corpus = "corpora/rtp-depacketizer-av1-assemble-frame-corpus" deps = [ ":fuzz_data_helper", "../../api:array_view", diff --git a/test/fuzzers/corpora/rtp-depacketizer-av1-assemble-frame-corpus/av1-assemble-frame-0 b/test/fuzzers/corpora/rtp-depacketizer-av1-assemble-frame-corpus/av1-assemble-frame-0 new file mode 100644 index 0000000000..540a770e29 --- /dev/null +++ b/test/fuzzers/corpora/rtp-depacketizer-av1-assemble-frame-corpus/av1-assemble-frame-0 @@ -0,0 +1 @@ +ô0ÿÿÿ¸¸¸ \ No newline at end of file