RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/wmalosslessdec: fix overflow with pred in revert_cdlms 

Fixes: signed integer overflow: 2048 + 2147483646 cannot be represented in type 'int'
Fixes: 23538/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5227567073460224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 21598d711d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2020-06-28 00:10:19 +02:00
parent c92265be90
commit ba0c96ecd3
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/wmalosslessdec.c
View File

@ -761,7 +761,8 @@ static void lms_update ## bits (WmallDecodeCtx *s, int ich, int ilms, int input)
static void revert_cdlms ## bits (WmallDecodeCtx *s, int ch, \ static void revert_cdlms ## bits (WmallDecodeCtx *s, int ch, \
int coef_begin, int coef_end) \ int coef_begin, int coef_end) \
{ \ { \
int icoef, pred, ilms, num_lms, residue, input; \ int icoef, ilms, num_lms, residue, input; \
unsigned pred;\
\ \
num_lms = s->cdlms_ttl[ch]; \ num_lms = s->cdlms_ttl[ch]; \
for (ilms = num_lms - 1; ilms >= 0; ilms--) { \ for (ilms = num_lms - 1; ilms >= 0; ilms--) { \
@ -775,7 +776,7 @@ static void revert_cdlms ## bits (WmallDecodeCtx *s, int ch, \
s->cdlms[ch][ilms].recent, \ s->cdlms[ch][ilms].recent, \
FFALIGN(s->cdlms[ch][ilms].order, ROUND), \ FFALIGN(s->cdlms[ch][ilms].order, ROUND), \
WMASIGN(residue)); \ WMASIGN(residue)); \
input = residue + (unsigned)(pred >> s->cdlms[ch][ilms].scaling); \ input = residue + (unsigned)((int)pred >> s->cdlms[ch][ilms].scaling); \
lms_update ## bits(s, ch, ilms, input); \ lms_update ## bits(s, ch, ilms, input); \
s->channel_residues[ch][icoef] = input; \ s->channel_residues[ch][icoef] = input; \
} \ } \