RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/dirac_dwt_template: Fix several integer overflows in horizontal_compose_daub97i() 

Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 8926/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6047609228623872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2018-07-22 19:11:04 +02:00
parent 5129040646
commit 69cac9e130
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/dirac_dwt_template.c
View File

@ -190,15 +190,15 @@ static void RENAME(horizontal_compose_daub97i)(uint8_t *_b, uint8_t *_temp, int
// second stage combined with interleave and shift // second stage combined with interleave and shift
b0 = b2 = COMPOSE_DAUB97iL0(temp[w2], temp[0], temp[w2]); b0 = b2 = COMPOSE_DAUB97iL0(temp[w2], temp[0], temp[w2]);
b[0] = (b0 + 1) >> 1; b[0] = ~((~b0) >> 1);
for (x = 1; x < w2; x++) { for (x = 1; x < w2; x++) {
b2 = COMPOSE_DAUB97iL0(temp[x+w2-1], temp[x ], temp[x+w2]); b2 = COMPOSE_DAUB97iL0(temp[x+w2-1], temp[x ], temp[x+w2]);
b1 = COMPOSE_DAUB97iH0( b0, temp[x+w2-1], b2 ); b1 = COMPOSE_DAUB97iH0( b0, temp[x+w2-1], b2 );
b[2*x-1] = (b1 + 1) >> 1; b[2*x-1] = ~((~b1) >> 1);
b[2*x ] = (b2 + 1) >> 1; b[2*x ] = ~((~b2) >> 1);
b0 = b2; b0 = b2;
} }
b[w-1] = (COMPOSE_DAUB97iH0(b2, temp[w-1], b2) + 1) >> 1; b[w-1] = ~((~COMPOSE_DAUB97iH0(b2, temp[w-1], b2)) >> 1);
} }
static void RENAME(vertical_compose_dirac53iH0)(uint8_t *_b0, uint8_t *_b1, uint8_t *_b2, static void RENAME(vertical_compose_dirac53iH0)(uint8_t *_b0, uint8_t *_b1, uint8_t *_b2,