diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-06-26 15:00:52 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-06-26 16:06:25 +0200 |
| commit | 3c70251780647d49e09522bbe22758c841e37a9a (patch) | |
| tree | 20628f167aba34cd445068baeadbfab2b377bed9 | |
| parent | ea5366670e26b2c6c396e6a5f49827a2b71e6dd6 (diff) | |
| download | ffmpeg-3c70251780647d49e09522bbe22758c841e37a9a.tar.gz | |
avcodec/jpeg2000dwt: Fix integer overflows in sr_1d97_int()
Fixes: runtime error: signed integer overflow: 1157259380 + 1157259380 cannot be represented in type 'int'
Fixes: 2365/clusterfuzz-testcase-minimized-6020421927305216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/jpeg2000dwt.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/libavcodec/jpeg2000dwt.c b/libavcodec/jpeg2000dwt.c index e4aa2e4a3d..55dd5e89b5 100644 --- a/libavcodec/jpeg2000dwt.c +++ b/libavcodec/jpeg2000dwt.c @@ -464,16 +464,16 @@ static void sr_1d97_int(int32_t *p, int i0, int i1) extend97_int(p, i0, i1); for (i = (i0 >> 1) - 1; i < (i1 >> 1) + 2; i++) - p[2 * i] -= (I_LFTG_DELTA * (p[2 * i - 1] + p[2 * i + 1]) + (1 << 15)) >> 16; + p[2 * i] -= (I_LFTG_DELTA * (p[2 * i - 1] + (int64_t)p[2 * i + 1]) + (1 << 15)) >> 16; /* step 4 */ for (i = (i0 >> 1) - 1; i < (i1 >> 1) + 1; i++) - p[2 * i + 1] -= (I_LFTG_GAMMA * (p[2 * i] + p[2 * i + 2]) + (1 << 15)) >> 16; + p[2 * i + 1] -= (I_LFTG_GAMMA * (p[2 * i] + (int64_t)p[2 * i + 2]) + (1 << 15)) >> 16; /*step 5*/ for (i = (i0 >> 1); i < (i1 >> 1) + 1; i++) - p[2 * i] += (I_LFTG_BETA * (p[2 * i - 1] + p[2 * i + 1]) + (1 << 15)) >> 16; + p[2 * i] += (I_LFTG_BETA * (p[2 * i - 1] + (int64_t)p[2 * i + 1]) + (1 << 15)) >> 16; /* step 6 */ for (i = (i0 >> 1); i < (i1 >> 1); i++) - p[2 * i + 1] += (I_LFTG_ALPHA * (p[2 * i] + p[2 * i + 2]) + (1 << 15)) >> 16; + p[2 * i + 1] += (I_LFTG_ALPHA * (p[2 * i] + (int64_t)p[2 * i + 2]) + (1 << 15)) >> 16; } static void dwt_decode97_int(DWTContext *s, int32_t *t) |