RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/wavarc: Fix several integer overflows 

Fixes: signed integer overflow: -532410125 + -1759642300 cannot be represented in type 'int'
Fixes: 57045/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-637023665297817

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2023-03-26 19:49:21 +02:00
parent 5f92a19231
commit 1942dbb8ca
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/wavarc.c
View File

@ -349,7 +349,7 @@ static int decode_2slp(AVCodecContext *avctx,
int sum = 15; int sum = 15;
for (int o = 0; o < order; o++) for (int o = 0; o < order; o++)
sum += s->filter[ch][o] * samples[n + 70 - o - 1]; sum += s->filter[ch][o] * (unsigned)samples[n + 70 - o - 1];
samples[n + 70] = get_srice(gb, k) + (sum >> 4); samples[n + 70] = get_srice(gb, k) + (sum >> 4);
} }
@ -452,7 +452,7 @@ fail:
const int *src = s->samples[ch] + s->offset; const int *src = s->samples[ch] + s->offset;
for (int n = 0; n < frame->nb_samples; n++) for (int n = 0; n < frame->nb_samples; n++)
dst[n] = src[n] * (1 << s->shift) + 0x80U; dst[n] = src[n] * (1U << s->shift) + 0x80U;
} }
break; break;
case AV_SAMPLE_FMT_S16P: case AV_SAMPLE_FMT_S16P:
@ -461,7 +461,7 @@ fail:
const int *src = s->samples[ch] + s->offset; const int *src = s->samples[ch] + s->offset;
for (int n = 0; n < frame->nb_samples; n++) for (int n = 0; n < frame->nb_samples; n++)
dst[n] = src[n] * (1 << s->shift); dst[n] = src[n] * (1U << s->shift);
} }
break; break;
} }