RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/aacsbr_fixed: Fix multiple runtime error: shift exponent 170 is too large for 32-bit type 'int' 

Fixes part of 1709/clusterfuzz-testcase-minimized-4513580554649600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-05-21 00:06:10 +02:00
parent 8794cfbbc5
commit 6310fc714d
1 changed files with 15 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
libavcodec/aacsbr_fixed.c
View File

@ -575,20 +575,25 @@ static void sbr_hf_assemble(int Y1[38][64][2],
SoftFloat *in = sbr->s_m[e];
for (m = 0; m+1 < m_max; m+=2) {
shift = 22 - in[m ].exp;
round = 1 << (shift-1);
out[2*m ] += (in[m ].mant * A + round) >> shift;
shift = 22 - in[m ].exp;
if (shift < 32) {
round = 1 << (shift-1);
out[2*m ] += (in[m ].mant * A + round) >> shift;
}
shift = 22 - in[m+1].exp;
round = 1 << (shift-1);
out[2*m+2] += (in[m+1].mant * B + round) >> shift;
shift = 22 - in[m+1].exp;
if (shift < 32) {
round = 1 << (shift-1);
out[2*m+2] += (in[m+1].mant * B + round) >> shift;
}
}
if(m_max&1)
{
shift = 22 - in[m ].exp;
round = 1 << (shift-1);
out[2*m ] += (in[m ].mant * A + round) >> shift;
shift = 22 - in[m ].exp;
if (shift < 32) {
round = 1 << (shift-1);
out[2*m ] += (in[m ].mant * A + round) >> shift;
}
}
}
indexnoise = (indexnoise + m_max) & 0x1ff;