diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2015-12-03 01:08:53 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2015-12-03 02:28:00 +0100 |
| commit | 0afdfbe11678d813ce7865378276a0ba476a8cef (patch) | |
| tree | c7aee4bd37bcb81c6c9d0b64663169c55d0f50fc | |
| parent | d64b6c38198ea35a08ceda396ebc4745138ad6ec (diff) | |
| download | ffmpeg-0afdfbe11678d813ce7865378276a0ba476a8cef.tar.gz | |
avcodec/jpeg2000: fix type of arguments of tag_tree_size
Fixes: out of array read
Fixes: 36b8096fefab16c4c9326a508053e95c/signal_sigsegv_1d9ce18_3233_1a55196b018106dfabeace071a432d9e.r3d
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/jpeg2000.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libavcodec/jpeg2000.c b/libavcodec/jpeg2000.c index cbca18e2ca..c98840971f 100644 --- a/libavcodec/jpeg2000.c +++ b/libavcodec/jpeg2000.c @@ -38,11 +38,11 @@ /* tag tree routines */ /* allocate the memory for tag tree */ -static int32_t tag_tree_size(uint16_t w, uint16_t h) +static int32_t tag_tree_size(int w, int h) { - uint32_t res = 0; + int64_t res = 0; while (w > 1 || h > 1) { - res += w * h; + res += w * (int64_t)h; av_assert0(res + 1 < INT32_MAX); w = (w + 1) >> 1; h = (h + 1) >> 1; |