aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2018-02-18 21:51:38 +0100
committerMichael Niedermayer <michael@niedermayer.cc>2018-06-18 01:16:03 +0200
commit2b5c0fdaaca56408ab394b093d8e766f976d79a7 (patch)
tree0e9e6040ab5b19e060ceafce058bf5d94d042d06
parentbc194927e4aec708851b540c29b973ac5c3d5bec (diff)
downloadffmpeg-2b5c0fdaaca56408ab394b093d8e766f976d79a7.tar.gz
avcodec/diracdec: Fix integer overflow in mv computation
Fixes: signed integer overflow: -2072 + -2147483646 cannot be represented in type 'int' Fixes: 6097/clusterfuzz-testcase-minimized-5034145253163008 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 47e65ad63b3d067445c4de41a7718b83fc07767c) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-rw-r--r--libavcodec/diracdec.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c
index 1197cfb87e..2c8d94758c 100644
--- a/libavcodec/diracdec.c
+++ b/libavcodec/diracdec.c
@@ -1436,8 +1436,8 @@ static void decode_block_params(DiracContext *s, DiracArith arith[8], DiracBlock
global_mv(s, block, x, y, i);
} else {
pred_mv(block, stride, x, y, i);
- block->u.mv[i][0] += dirac_get_arith_int(arith + 4 + 2 * i, CTX_MV_F1, CTX_MV_DATA);
- block->u.mv[i][1] += dirac_get_arith_int(arith + 5 + 2 * i, CTX_MV_F1, CTX_MV_DATA);
+ block->u.mv[i][0] += (unsigned)dirac_get_arith_int(arith + 4 + 2 * i, CTX_MV_F1, CTX_MV_DATA);
+ block->u.mv[i][1] += (unsigned)dirac_get_arith_int(arith + 5 + 2 * i, CTX_MV_F1, CTX_MV_DATA);
}
}
}