diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-09-27 17:01:38 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-07-01 12:49:26 +0200 |
| commit | 1334b5dae17d467c9a6f96a778e004dccab42132 (patch) | |
| tree | 9944b6bf64278e169707f371774dd941621f0c3f | |
| parent | ac28d793c1e8989d2288303589a818d575e739b7 (diff) | |
| download | ffmpeg-1334b5dae17d467c9a6f96a778e004dccab42132.tar.gz | |
avcodec/g729postfilter: Fix undefined shifts
Fixes: left shift of negative value -12
Fixes: 17689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5756275014500352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6a4fdbf112385824fc9b7d7739685359213b579a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/g729postfilter.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/libavcodec/g729postfilter.c b/libavcodec/g729postfilter.c index d9076ec735..e8e031a1ed 100644 --- a/libavcodec/g729postfilter.c +++ b/libavcodec/g729postfilter.c @@ -156,7 +156,7 @@ static int16_t long_term_filter(AudioDSPContext *adsp, int pitch_delay_int, sig_scaled[i] = residual[i] >> shift; else for (i = 0; i < subframe_size + RES_PREV_DATA_SIZE; i++) - sig_scaled[i] = residual[i] << -shift; + sig_scaled[i] = (unsigned)residual[i] << -shift; /* Start of best delay searching code */ gain_num = 0; @@ -500,14 +500,14 @@ static int16_t apply_tilt_comp(int16_t* out, int16_t* res_pst, int refl_coeff, tmp = res_pst[subframe_size - 1]; for (i = subframe_size - 1; i >= 1; i--) { - tmp2 = (res_pst[i] << 15) + ((gt * res_pst[i-1]) << 1); - tmp2 = (tmp2 + 0x4000) >> 15; + tmp2 = (gt * res_pst[i-1]) * 2 + 0x4000; + tmp2 = res_pst[i] + (tmp2 >> 15); tmp2 = (tmp2 * ga * 2 + fact) >> sh_fact; out[i] = tmp2; } - tmp2 = (res_pst[0] << 15) + ((gt * ht_prev_data) << 1); - tmp2 = (tmp2 + 0x4000) >> 15; + tmp2 = (gt * ht_prev_data) * 2 + 0x4000; + tmp2 = res_pst[0] + (tmp2 >> 15); tmp2 = (tmp2 * ga * 2 + fact) >> sh_fact; out[0] = tmp2; |