diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-10-28 01:23:40 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-10-28 15:00:02 +0100 |
| commit | 1ec6a3c768b28296022dd5eee08863a313ff1acb (patch) | |
| tree | 65e4d75451be4bbe0f3548202e859f945e3023e4 | |
| parent | 5c791b1c9ce0edab69d4aa9b17a967a3b3792a07 (diff) | |
| download | ffmpeg-1ec6a3c768b28296022dd5eee08863a313ff1acb.tar.gz | |
avcodec/diracdec: Use 64bit in calculation of codeblock coordinates
Fixes integer overflow
Fixes out of array read
Fixes: asan_heap-oob_107866c_42_041.drc
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 526886e6069636a918c8c04db17e864e3d8151c1)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/diracdec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c index a18c867a3a..a7ace3c9f6 100644 --- a/libavcodec/diracdec.c +++ b/libavcodec/diracdec.c @@ -611,10 +611,10 @@ static av_always_inline void decode_subband_internal(DiracContext *s, SubBand *b top = 0; for (cb_y = 0; cb_y < cb_height; cb_y++) { - bottom = (b->height * (cb_y+1)) / cb_height; + bottom = (b->height * (cb_y+1LL)) / cb_height; left = 0; for (cb_x = 0; cb_x < cb_width; cb_x++) { - right = (b->width * (cb_x+1)) / cb_width; + right = (b->width * (cb_x+1LL)) / cb_width; codeblock(s, b, &gb, &c, left, right, top, bottom, blockcnt_one, is_arith); left = right; } |