mirror of https://git.ffmpeg.org/ffmpeg.git
avcodec/truemotion2: fix integer overflows in tm2_low_chroma()
Fixes: 11295/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-4888953459572736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2ae39d7956
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
0e11b29834
commit
040aa14074
|
@ -480,7 +480,7 @@ static inline void tm2_high_chroma(int *data, int stride, int *last, unsigned *C
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
static inline void tm2_low_chroma(int *data, int stride, int *clast, int *CD, int *deltas, int bx)
|
static inline void tm2_low_chroma(int *data, int stride, int *clast, unsigned *CD, int *deltas, int bx)
|
||||||
{
|
{
|
||||||
int t;
|
int t;
|
||||||
int l;
|
int l;
|
||||||
|
@ -490,8 +490,8 @@ static inline void tm2_low_chroma(int *data, int stride, int *clast, int *CD, in
|
||||||
prev = clast[-3];
|
prev = clast[-3];
|
||||||
else
|
else
|
||||||
prev = 0;
|
prev = 0;
|
||||||
t = (CD[0] + CD[1]) >> 1;
|
t = (int)(CD[0] + CD[1]) >> 1;
|
||||||
l = (prev - CD[0] - CD[1] + clast[1]) >> 1;
|
l = (int)(prev - CD[0] - CD[1] + clast[1]) >> 1;
|
||||||
CD[1] = CD[0] + CD[1] - t;
|
CD[1] = CD[0] + CD[1] - t;
|
||||||
CD[0] = t;
|
CD[0] = t;
|
||||||
clast[0] = l;
|
clast[0] = l;
|
||||||
|
|
Loading…
Reference in New Issue