RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/qdmc: Fix integer overflows in PRNG 

Fixes: signed integer overflow: 214013 * 2531011 cannot be represented in type 'int'
Fixes: 15254/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDMC_fuzzer-5698137026461696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-06-16 15:53:27 +02:00
parent d57f6606eb
commit 2921b45a38
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/qdmc.c
View File

@ -577,9 +577,9 @@ static void add_noise(QDMCContext *s, int ch, int current_subframe)
for (j = 2; j < s->subframe_size - 1; j++) {
float rnd_re, rnd_im;
s->rndval = 214013 * s->rndval + 2531011;
s->rndval = 214013U * s->rndval + 2531011;
rnd_im = ((s->rndval & 0x7FFF) - 16384.0f) * 0.000030517578f * s->noise2_buffer[j];
s->rndval = 214013 * s->rndval + 2531011;
s->rndval = 214013U * s->rndval + 2531011;
rnd_re = ((s->rndval & 0x7FFF) - 16384.0f) * 0.000030517578f * s->noise2_buffer[j];
im[j ] += rnd_im;
re[j ] += rnd_re;