diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2018-06-05 13:19:35 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2018-06-18 01:16:04 +0200 |
| commit | 5d61400740842ad0b90528a0bce54e577d21e0d7 (patch) | |
| tree | 52d89fd2a8b50916d492ab0d6e20b6919bcb7b75 | |
| parent | 62e1c5db4acc208c09bba83ba6a964a20be04bd2 (diff) | |
| download | ffmpeg-5d61400740842ad0b90528a0bce54e577d21e0d7.tar.gz | |
avcodec/shorten: Fix multiple integer overflows
Fixes: signed integer overflow: 3 * 1006632960 cannot be represented in type 'int'
Fixes: 8278/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5692857166856192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f2abd36b3863188894fd21964c662b6c17268bfb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/shorten.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/shorten.c b/libavcodec/shorten.c index 0bd3e1e5f7..18a12d0b97 100644 --- a/libavcodec/shorten.c +++ b/libavcodec/shorten.c @@ -389,7 +389,7 @@ static int decode_subframe_lpc(ShortenContext *s, int command, int channel, for (i = 0; i < s->blocksize; i++) { sum = init_sum; for (j = 0; j < pred_order; j++) - sum += coeffs[j] * s->decoded[channel][i - j - 1]; + sum += coeffs[j] * (unsigned)s->decoded[channel][i - j - 1]; s->decoded[channel][i] = get_sr_golomb_shorten(&s->gb, residual_size) + (sum >> qshift); } @@ -700,7 +700,7 @@ static int shorten_decode_frame(AVCodecContext *avctx, void *data, /* update means with info from the current block */ if (s->nmean > 0) { - int32_t sum = (s->version < 2) ? 0 : s->blocksize / 2; + int64_t sum = (s->version < 2) ? 0 : s->blocksize / 2; for (i = 0; i < s->blocksize; i++) sum += s->decoded[channel][i]; |