diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-06-16 15:53:27 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-11-11 20:18:46 +0100 |
| commit | 1e414045e71fcd60d7d87a6dc9706b14cdbf5ef6 (patch) | |
| tree | 093449cbf5579d158a8ac147cc2c1fd54ba2756a | |
| parent | 20b3decce11bf7da94a707fa0c76d38d9689fbd8 (diff) | |
| download | ffmpeg-1e414045e71fcd60d7d87a6dc9706b14cdbf5ef6.tar.gz | |
avcodec/qdmc: Fix integer overflows in PRNG
Fixes: signed integer overflow: 214013 * 2531011 cannot be represented in type 'int'
Fixes: 15254/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDMC_fuzzer-5698137026461696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2921b45a388a81968d946996bb32e72d7bb5d5b7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/qdmc.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/qdmc.c b/libavcodec/qdmc.c index f1f86accd8..b40edc17cc 100644 --- a/libavcodec/qdmc.c +++ b/libavcodec/qdmc.c @@ -575,9 +575,9 @@ static void add_noise(QDMCContext *s, int ch, int current_subframe) for (j = 2; j < s->subframe_size - 1; j++) { float rnd_re, rnd_im; - s->rndval = 214013 * s->rndval + 2531011; + s->rndval = 214013U * s->rndval + 2531011; rnd_im = ((s->rndval & 0x7FFF) - 16384.0f) * 0.000030517578f * s->noise2_buffer[j]; - s->rndval = 214013 * s->rndval + 2531011; + s->rndval = 214013U * s->rndval + 2531011; rnd_re = ((s->rndval & 0x7FFF) - 16384.0f) * 0.000030517578f * s->noise2_buffer[j]; im[j ] += rnd_im; re[j ] += rnd_re; |