diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-06-06 17:45:39 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-07-05 12:43:08 +0200 |
| commit | 0d9270743785b61b49296717b2c01f70aa74d969 (patch) | |
| tree | e72c74b253a5954051668d66d4a3a11584a64821 | |
| parent | 02361a13efb90f94d9746d7087479822827723bb (diff) | |
| download | ffmpeg-0d9270743785b61b49296717b2c01f70aa74d969.tar.gz | |
avcodec/snowdec: Avoid integer overflow with huge qlog
Fixes: integer overflow
Fixes: 22285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5682428762128384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 38fbf33c7255b503453052c32ab5ae4fb151b29e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/snowdec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/snowdec.c b/libavcodec/snowdec.c index 84e98afe4c..5c82309301 100644 --- a/libavcodec/snowdec.c +++ b/libavcodec/snowdec.c @@ -114,7 +114,7 @@ static av_always_inline void predict_slice_buffered(SnowContext *s, slice_buffer static inline void decode_subband_slice_buffered(SnowContext *s, SubBand *b, slice_buffer * sb, int start_y, int h, int save_state[1]){ const int w= b->width; int y; - const int qlog= av_clip(s->qlog + b->qlog, 0, QROOT*16); + const int qlog= av_clip(s->qlog + (int64_t)b->qlog, 0, QROOT*16); int qmul= ff_qexp[qlog&(QROOT-1)]<<(qlog>>QSHIFT); int qadd= (s->qbias*qmul)>>QBIAS_SHIFT; int new_index = 0; @@ -221,7 +221,7 @@ static int decode_q_branch(SnowContext *s, int level, int x, int y){ static void dequantize_slice_buffered(SnowContext *s, slice_buffer * sb, SubBand *b, IDWTELEM *src, int stride, int start_y, int end_y){ const int w= b->width; - const int qlog= av_clip(s->qlog + b->qlog, 0, QROOT*16); + const int qlog= av_clip(s->qlog + (int64_t)b->qlog, 0, QROOT*16); const int qmul= ff_qexp[qlog&(QROOT-1)]<<(qlog>>QSHIFT); const int qadd= (s->qbias*qmul)>>QBIAS_SHIFT; int x,y; |