RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

swscale/swscale: prevent integer overflow in chrRangeToJpeg16_c 

Same as it's done in lumRangeToJpeg16_c(). Plenty of allowed input values can
overflow here.

Fixes: src/libswscale/swscale.c:198:47: runtime error: signed integer overflow: 475328 * 4663 cannot be represented in type 'int'
Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
James Almer 2024-10-31 23:19:29 -03:00
parent c029a2f7dd
commit 5f5421ec66
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libswscale/swscale.c
View File

@ -194,8 +194,8 @@ static void chrRangeToJpeg16_c(int16_t *_dstU, int16_t *_dstV, int width)
int32_t *dstU = (int32_t *) _dstU; int32_t *dstU = (int32_t *) _dstU;
int32_t *dstV = (int32_t *) _dstV; int32_t *dstV = (int32_t *) _dstV;
for (i = 0; i < width; i++) { for (i = 0; i < width; i++) {
dstU[i] = (FFMIN(dstU[i], 30775 << 4) * 4663 - (9289992 << 4)) >> 12; // -264 dstU[i] = ((int)(FFMIN(dstU[i], 30775 << 4) * 4663U - (9289992 << 4))) >> 12; // -264
dstV[i] = (FFMIN(dstV[i], 30775 << 4) * 4663 - (9289992 << 4)) >> 12; // -264 dstV[i] = ((int)(FFMIN(dstV[i], 30775 << 4) * 4663U - (9289992 << 4))) >> 12; // -264
} }
} }