diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2023-06-01 23:35:10 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2023-09-04 21:45:51 +0200 |
| commit | 0adaa90d89114dc86dbc5704ce31ded5b6750d13 (patch) | |
| tree | a13fcf152905e737240325568a6e0e3fbe5063bb | |
| parent | 5a16eb78db1c256ddb48951c674b623a24cdd44b (diff) | |
| download | ffmpeg-0adaa90d89114dc86dbc5704ce31ded5b6750d13.tar.gz | |
avcodec/mpeg4videodec: more unsigned in amv computation
Fixes: signed integer overflow: -2147483648 + -1048576 cannot be represented in type 'int'
Fixes: 59365/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-642654923954585
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/mpeg4videodec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c index 30aec5e529..f7f0ff59e8 100644 --- a/libavcodec/mpeg4videodec.c +++ b/libavcodec/mpeg4videodec.c @@ -861,7 +861,7 @@ static inline int get_amv(Mpeg4DecContext *ctx, int n) for (y = 0; y < 16; y++) { int v; - v = mb_v + dy * y; + v = mb_v + (unsigned)dy * y; // FIXME optimize for (x = 0; x < 16; x++) { sum += v >> shift; |