RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/mdct_*: Fix integer overflow in addition in RESCALE() 

Fixes: runtime error: signed integer overflow: 1219998458 - -1469874012 cannot be represented in type 'int'
Fixes: 3443/clusterfuzz-testcase-minimized-5369987105554432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 770c934fa1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-11-05 21:20:06 +01:00
parent c8027878d0
commit c1d31ccfac
2 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/mdct_fixed.c
View File

@ -39,13 +39,13 @@ void ff_mdct_calcw_c(FFTContext *s, FFTDouble *out, const FFTSample *input)
/* pre rotation */
for(i=0;i<n8;i++) {
re = RSCALE(-input[2*i+n3] - input[n3-1-2*i]);
im = RSCALE(-input[n4+2*i] + input[n4-1-2*i]);
re = RSCALE(-input[2*i+n3], - input[n3-1-2*i]);
im = RSCALE(-input[n4+2*i], + input[n4-1-2*i]);
j = revtab[i];
CMUL(x[j].re, x[j].im, re, im, -tcos[i], tsin[i]);
re = RSCALE( input[2*i] - input[n2-1-2*i]);
im = RSCALE(-input[n2+2*i] - input[ n-1-2*i]);
re = RSCALE( input[2*i] , - input[n2-1-2*i]);
im = RSCALE(-input[n2+2*i], - input[ n-1-2*i]);
j = revtab[n8 + i];
CMUL(x[j].re, x[j].im, re, im, -tcos[n8 + i], tsin[n8 + i]);
}

14
libavcodec/mdct_template.c
View File

@ -33,12 +33,12 @@
*/
#if FFT_FLOAT
# define RSCALE(x) (x)
# define RSCALE(x, y) ((x) + (y))
#else
#if FFT_FIXED_32
# define RSCALE(x) (((x) + 32) >> 6)
# define RSCALE(x, y) ((int)((x) + (unsigned)(y) + 32) >> 6)
#else /* FFT_FIXED_32 */
# define RSCALE(x) ((x) >> 1)
# define RSCALE(x, y) ((int)((x) + (unsigned)(y)) >> 1)
#endif /* FFT_FIXED_32 */
#endif
@ -181,13 +181,13 @@ void ff_mdct_calc_c(FFTContext *s, FFTSample *out, const FFTSample *input)
/* pre rotation */
for(i=0;i<n8;i++) {
re = RSCALE(-input[2*i+n3] - input[n3-1-2*i]);
im = RSCALE(-input[n4+2*i] + input[n4-1-2*i]);
re = RSCALE(-input[2*i+n3], - input[n3-1-2*i]);
im = RSCALE(-input[n4+2*i], + input[n4-1-2*i]);
j = revtab[i];
CMUL(x[j].re, x[j].im, re, im, -tcos[i], tsin[i]);
re = RSCALE( input[2*i] - input[n2-1-2*i]);
im = RSCALE(-input[n2+2*i] - input[ n-1-2*i]);
re = RSCALE( input[2*i] , - input[n2-1-2*i]);
im = RSCALE(-input[n2+2*i], - input[ n-1-2*i]);
j = revtab[n8 + i];
CMUL(x[j].re, x[j].im, re, im, -tcos[n8 + i], tsin[n8 + i]);
}