RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/simple_idct_template: Fix integer overflow in idctSparseCol() 

Fixes: signed integer overflow: -1027919784 + -1120041624 cannot be represented in type 'int'
Fixes: 15406/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5700646528876544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-06-26 00:03:01 +02:00
parent 7b114d7687
commit b5f2cfd2ad
1 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
libavcodec/simple_idct_template.c
View File

@ -312,18 +312,18 @@ static inline void FUNC6(idctSparseColAdd)(pixel *dest, ptrdiff_t line_size,
static inline void FUNC6(idctSparseCol)(idctin *col)
#endif
{
int a0, a1, a2, a3, b0, b1, b2, b3;
unsigned a0, a1, a2, a3, b0, b1, b2, b3;
IDCT_COLS;
col[0 ] = ((a0 + b0) >> COL_SHIFT);
col[8 ] = ((a1 + b1) >> COL_SHIFT);
col[16] = ((a2 + b2) >> COL_SHIFT);
col[24] = ((a3 + b3) >> COL_SHIFT);
col[32] = ((a3 - b3) >> COL_SHIFT);
col[40] = ((a2 - b2) >> COL_SHIFT);
col[48] = ((a1 - b1) >> COL_SHIFT);
col[56] = ((a0 - b0) >> COL_SHIFT);
col[0 ] = ((int)(a0 + b0) >> COL_SHIFT);
col[8 ] = ((int)(a1 + b1) >> COL_SHIFT);
col[16] = ((int)(a2 + b2) >> COL_SHIFT);
col[24] = ((int)(a3 + b3) >> COL_SHIFT);
col[32] = ((int)(a3 - b3) >> COL_SHIFT);
col[40] = ((int)(a2 - b2) >> COL_SHIFT);
col[48] = ((int)(a1 - b1) >> COL_SHIFT);
col[56] = ((int)(a0 - b0) >> COL_SHIFT);
}
#ifndef EXTRA_SHIFT