diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2021-10-12 14:50:41 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-10-17 22:20:07 +0200 |
| commit | 85c169f6a62ad4e357ab139a4511854525938323 (patch) | |
| tree | 5a5fc8b4770aef6ced8a73a79ea60ed570ff8a65 | |
| parent | 77970abb71d349bb9efea1b01619b8ec95411b94 (diff) | |
| download | ffmpeg-85c169f6a62ad4e357ab139a4511854525938323.tar.gz | |
avcodec/speexdec: Seed should be unsigned otherwise the operations done on it are undefined
Fixes: signed integer overflow: 1664525000 + 1013904223 cannot be represented in type 'int'
Fixes: 39865/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEX_fuzzer-4979694508834816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/speexdec.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/libavcodec/speexdec.c b/libavcodec/speexdec.c index fccceab74c..4c50f54f27 100644 --- a/libavcodec/speexdec.c +++ b/libavcodec/speexdec.c @@ -140,7 +140,7 @@ typedef void (*innovation_quant_func)(float *, float *, /** Innovation unquantization function */ typedef void (*innovation_unquant_func)(float *, const void *, int, - GetBitContext *, int32_t *); + GetBitContext *, uint32_t *); typedef struct SpeexSubmode { int lbr_pitch; /**< Set to -1 for "normal" modes, otherwise encode pitch using @@ -191,7 +191,7 @@ typedef struct DecoderState { /* This is used in packet loss concealment */ int last_pitch; /**< Pitch of last correctly decoded frame */ float last_pitch_gain; /**< Pitch gain of last correctly decoded frame */ - int32_t seed; /** Seed used for random number generation */ + uint32_t seed; /** Seed used for random number generation */ int encode_submode; const SpeexSubmode *const *submodes; /**< Sub-mode data */ @@ -293,7 +293,7 @@ static void forced_pitch_unquant(float *exc, float *exc_out, int start, int end, gain_val[1] = pitch_coef; } -static inline float speex_rand(float std, int32_t *seed) +static inline float speex_rand(float std, uint32_t *seed) { const uint32_t jflone = 0x3f800000; const uint32_t jflmsk = 0x007fffff; @@ -308,14 +308,14 @@ static inline float speex_rand(float std, int32_t *seed) } static void noise_codebook_unquant(float *exc, const void *par, int nsf, - GetBitContext *gb, int32_t *seed) + GetBitContext *gb, uint32_t *seed) { for (int i = 0; i < nsf; i++) exc[i] = speex_rand(1.f, seed); } static void split_cb_shape_sign_unquant(float *exc, const void *par, int nsf, - GetBitContext *gb, int32_t *seed) + GetBitContext *gb, uint32_t *seed) { int subvect_size, nb_subvect, have_sign, shape_bits; const SplitCodebookParams *params; |