RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/aacdec_template: Fix undefined integer overflow in apply_tns() 

Fixes: runtime error: signed integer overflow: -2147483648 - 1202286525 cannot be represented in type 'int'
Fixes: 2071/clusterfuzz-testcase-minimized-6036414271586304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-07-14 00:45:29 +02:00
parent d0ba0be355
commit 0ef8f03133
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/aac_defines.h
View File

@ -35,6 +35,7 @@
#define AAC_RENAME(x) x ## _fixed #define AAC_RENAME(x) x ## _fixed
#define AAC_RENAME_32(x) x ## _fixed_32 #define AAC_RENAME_32(x) x ## _fixed_32
typedef int INTFLOAT; typedef int INTFLOAT;
typedef unsigned UINTFLOAT; ///< Equivalent to INTFLOAT, Used as temporal cast to avoid undefined sign overflow operations.
typedef int64_t INT64FLOAT; typedef int64_t INT64FLOAT;
typedef int16_t SHORTFLOAT; typedef int16_t SHORTFLOAT;
typedef SoftFloat AAC_FLOAT; typedef SoftFloat AAC_FLOAT;
@ -83,6 +84,7 @@ typedef int AAC_SIGNE;
#define AAC_RENAME(x) x #define AAC_RENAME(x) x
#define AAC_RENAME_32(x) x #define AAC_RENAME_32(x) x
typedef float INTFLOAT; typedef float INTFLOAT;
typedef float UINTFLOAT;
typedef float INT64FLOAT; typedef float INT64FLOAT;
typedef float SHORTFLOAT; typedef float SHORTFLOAT;
typedef float AAC_FLOAT; typedef float AAC_FLOAT;

5
libavcodec/aacdec_template.c
View File

@ -2389,7 +2389,7 @@ static int decode_extension_payload(AACContext *ac, GetBitContext *gb, int cnt,
* @param decode 1 if tool is used normally, 0 if tool is used in LTP. * @param decode 1 if tool is used normally, 0 if tool is used in LTP.
* @param coef spectral coefficients * @param coef spectral coefficients
*/ */
static void apply_tns(INTFLOAT coef[1024], TemporalNoiseShaping *tns, static void apply_tns(INTFLOAT coef_param[1024], TemporalNoiseShaping *tns,
IndividualChannelStream *ics, int decode) IndividualChannelStream *ics, int decode)
{ {
const int mmm = FFMIN(ics->tns_max_bands, ics->max_sfb); const int mmm = FFMIN(ics->tns_max_bands, ics->max_sfb);
@ -2397,6 +2397,7 @@ static void apply_tns(INTFLOAT coef[1024], TemporalNoiseShaping *tns,
int bottom, top, order, start, end, size, inc; int bottom, top, order, start, end, size, inc;
INTFLOAT lpc[TNS_MAX_ORDER]; INTFLOAT lpc[TNS_MAX_ORDER];
INTFLOAT tmp[TNS_MAX_ORDER+1]; INTFLOAT tmp[TNS_MAX_ORDER+1];
UINTFLOAT *coef = coef_param;
for (w = 0; w < ics->num_windows; w++) { for (w = 0; w < ics->num_windows; w++) {
bottom = ics->num_swb; bottom = ics->num_swb;
@ -2426,7 +2427,7 @@ static void apply_tns(INTFLOAT coef[1024], TemporalNoiseShaping *tns,
// ar filter // ar filter
for (m = 0; m < size; m++, start += inc) for (m = 0; m < size; m++, start += inc)
for (i = 1; i <= FFMIN(m, order); i++) for (i = 1; i <= FFMIN(m, order); i++)
coef[start] -= AAC_MUL26(coef[start - i * inc], lpc[i - 1]); coef[start] -= AAC_MUL26((INTFLOAT)coef[start - i * inc], lpc[i - 1]);
} else { } else {
// ma filter // ma filter
for (m = 0; m < size; m++, start += inc) { for (m = 0; m < size; m++, start += inc) {