RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/s302m: Fix left shift of 8 by 28 places cannot be represented in type 'int' 

Fixes: 1395/clusterfuzz-testcase-minimized-5330939741732864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-05-07 15:44:51 +02:00
parent 0ac1c87194
commit a38e9797cb
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/s302m.c
View File

@ -120,10 +120,10 @@ static int s302m_decode_frame(AVCodecContext *avctx, void *data,
if (avctx->bits_per_raw_sample == 24) { if (avctx->bits_per_raw_sample == 24) {
uint32_t *o = (uint32_t *)frame->data[0]; uint32_t *o = (uint32_t *)frame->data[0];
for (; buf_size > 6; buf_size -= 7) { for (; buf_size > 6; buf_size -= 7) {
*o++ = (ff_reverse[buf[2]] << 24) | *o++ = ((unsigned)ff_reverse[buf[2]] << 24) |
(ff_reverse[buf[1]] << 16) | (ff_reverse[buf[1]] << 16) |
(ff_reverse[buf[0]] << 8); (ff_reverse[buf[0]] << 8);
*o++ = (ff_reverse[buf[6] & 0xf0] << 28) | *o++ = ((unsigned)ff_reverse[buf[6] & 0xf0] << 28) |
(ff_reverse[buf[5]] << 20) | (ff_reverse[buf[5]] << 20) |
(ff_reverse[buf[4]] << 12) | (ff_reverse[buf[4]] << 12) |
(ff_reverse[buf[3] & 0x0f] << 4); (ff_reverse[buf[3] & 0x0f] << 4);
@ -142,10 +142,10 @@ static int s302m_decode_frame(AVCodecContext *avctx, void *data,
} else if (avctx->bits_per_raw_sample == 20) { } else if (avctx->bits_per_raw_sample == 20) {
uint32_t *o = (uint32_t *)frame->data[0]; uint32_t *o = (uint32_t *)frame->data[0];
for (; buf_size > 5; buf_size -= 6) { for (; buf_size > 5; buf_size -= 6) {
*o++ = (ff_reverse[buf[2] & 0xf0] << 28) | *o++ = ((unsigned)ff_reverse[buf[2] & 0xf0] << 28) |
(ff_reverse[buf[1]] << 20) | (ff_reverse[buf[1]] << 20) |
(ff_reverse[buf[0]] << 12); (ff_reverse[buf[0]] << 12);
*o++ = (ff_reverse[buf[5] & 0xf0] << 28) | *o++ = ((unsigned)ff_reverse[buf[5] & 0xf0] << 28) |
(ff_reverse[buf[4]] << 20) | (ff_reverse[buf[4]] << 20) |
(ff_reverse[buf[3]] << 12); (ff_reverse[buf[3]] << 12);
buf += 6; buf += 6;