diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-10-26 21:30:19 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2022-04-13 23:39:50 +0200 |
| commit | 14eea4ade4cc02074ca22e13979ea8234dba6332 (patch) | |
| tree | a729c0e46db1c671824950d8ae08d05ef6d0f94a | |
| parent | 92521686ce4b0c607d5d8a57a2f7dadfc08f40f5 (diff) | |
| download | ffmpeg-14eea4ade4cc02074ca22e13979ea8234dba6332.tar.gz | |
avcodec/pixlet: Avoid signed integer overflow in scaling in filterfn()
Fixes: signed integer overflow: 11494 * 1073741824000000 cannot be represented in type 'long'
Fixes: 26586/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PIXLET_fuzzer-5752633970917376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0c1f20c6c858b753effda274b58ef635d1924915)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/pixlet.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/pixlet.c b/libavcodec/pixlet.c index aa7ef55b7d..611a5cd200 100644 --- a/libavcodec/pixlet.c +++ b/libavcodec/pixlet.c @@ -396,7 +396,7 @@ static void filterfn(int16_t *dest, int16_t *tmp, unsigned size, int64_t scale) (int64_t) low [i - 1] * -INT64_C(325392907) + (int64_t) high[i + 0] * INT64_C(1518500249) + (int64_t) high[i - 1] * INT64_C(1518500249); - dest[i * 2] = av_clip_int16(((value >> 32) * scale) >> 32); + dest[i * 2] = av_clip_int16(((value >> 32) * (uint64_t)scale) >> 32); } for (i = 0; i < hsize; i++) { @@ -407,7 +407,7 @@ static void filterfn(int16_t *dest, int16_t *tmp, unsigned size, int64_t scale) (int64_t) high[i + 1] * INT64_C(303700064) + (int64_t) high[i + 0] * -INT64_C(3644400640) + (int64_t) high[i - 1] * INT64_C(303700064); - dest[i * 2 + 1] = av_clip_int16(((value >> 32) * scale) >> 32); + dest[i * 2 + 1] = av_clip_int16(((value >> 32) * (uint64_t)scale) >> 32); } } |