RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/xvididct: Fix integer overflow in idct_row() 

Fixes: signed integer overflow: -1403461578 + -843974775 cannot be represented in type 'int'
Fixes: 60868/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-4599793035378688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ce322a51e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2023-08-07 00:02:21 +02:00
parent 5a88bf8ee7
commit 13d0022307
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 12 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
libavcodec/xvididct.c
View File

@ -69,24 +69,24 @@ static int idct_row(short *in, const int *const tab, int rnd)
if (!(right | in[4])) {
const int k = c4 * in[0] + rnd;
if (left) {
const int a0 = k + c2 * in[2];
const int a1 = k + c6 * in[2];
const int a2 = k - c6 * in[2];
const int a3 = k - c2 * in[2];
const unsigned a0 = k + c2 * in[2];
const unsigned a1 = k + c6 * in[2];
const unsigned a2 = k - c6 * in[2];
const unsigned a3 = k - c2 * in[2];
const int b0 = c1 * in[1] + c3 * in[3];
const int b1 = c3 * in[1] - c7 * in[3];
const int b2 = c5 * in[1] - c1 * in[3];
const int b3 = c7 * in[1] - c5 * in[3];
in[0] = (a0 + b0) >> ROW_SHIFT;
in[1] = (a1 + b1) >> ROW_SHIFT;
in[2] = (a2 + b2) >> ROW_SHIFT;
in[3] = (a3 + b3) >> ROW_SHIFT;
in[4] = (a3 - b3) >> ROW_SHIFT;
in[5] = (a2 - b2) >> ROW_SHIFT;
in[6] = (a1 - b1) >> ROW_SHIFT;
in[7] = (a0 - b0) >> ROW_SHIFT;
in[0] = (int)(a0 + b0) >> ROW_SHIFT;
in[1] = (int)(a1 + b1) >> ROW_SHIFT;
in[2] = (int)(a2 + b2) >> ROW_SHIFT;
in[3] = (int)(a3 + b3) >> ROW_SHIFT;
in[4] = (int)(a3 - b3) >> ROW_SHIFT;
in[5] = (int)(a2 - b2) >> ROW_SHIFT;
in[6] = (int)(a1 - b1) >> ROW_SHIFT;
in[7] = (int)(a0 - b0) >> ROW_SHIFT;
} else {
const int a0 = k >> ROW_SHIFT;
if (a0) {