RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/h264idct_template: Fix integer overflow in ff_h264_idct_add() 

Fixes: runtime error: signed integer overflow: 26215360 + 2121330944 cannot be represented in type 'int'
Fixes: 2809/clusterfuzz-testcase-minimized-4785181833560064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit d1bfa80ec4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-08-01 19:56:07 +02:00
parent c554788352
commit ef8db67c92
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/h264idct_template.c
View File

@ -40,10 +40,10 @@ void FUNCC(ff_h264_idct_add)(uint8_t *_dst, int16_t *_block, int stride)
block[0] += 1 << 5;
for(i=0; i<4; i++){
const SUINT z0= block[i + 4*0] + block[i + 4*2];
const SUINT z1= block[i + 4*0] - block[i + 4*2];
const SUINT z2= (block[i + 4*1]>>1) - block[i + 4*3];
const SUINT z3= block[i + 4*1] + (block[i + 4*3]>>1);
const SUINT z0= block[i + 4*0] + (unsigned)block[i + 4*2];
const SUINT z1= block[i + 4*0] - (unsigned)block[i + 4*2];
const SUINT z2= (block[i + 4*1]>>1) - (unsigned)block[i + 4*3];
const SUINT z3= block[i + 4*1] + (unsigned)(block[i + 4*3]>>1);
block[i + 4*0]= z0 + z3;
block[i + 4*1]= z1 + z2;