diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-03-08 21:41:34 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-05-16 16:00:22 +0200 |
| commit | 90c408fa65f36893811d81c8509fe7814cc48ebe (patch) | |
| tree | 6b0a1f1bf1e57b72a128b5914ec247630600d5f7 | |
| parent | 9beb60855bebcc25d342d680c4991a49a7fa8d5d (diff) | |
| download | ffmpeg-90c408fa65f36893811d81c8509fe7814cc48ebe.tar.gz | |
avcodec/mjpegdec: Fix runtime error: left shift of negative value -127
Fixes: 733/clusterfuzz-testcase-4682158096515072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 800d02abe041deacab5585bf41c1bc2ae5f4b922)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/mjpegdec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index 7a83383441..a073c0967e 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -1196,13 +1196,13 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor, PREDICT(pred, ptr[-linesize-1], ptr[-linesize], ptr[-1], predictor); pred &= mask; - *ptr = pred + (dc << point_transform); + *ptr = pred + ((unsigned)dc << point_transform); }else{ ptr16 = (uint16_t*)(s->picture_ptr->data[c] + 2*(linesize * (v * mb_y + y)) + 2*(h * mb_x + x)); //FIXME optimize this crap PREDICT(pred, ptr16[-linesize-1], ptr16[-linesize], ptr16[-1], predictor); pred &= mask; - *ptr16= pred + (dc << point_transform); + *ptr16= pred + ((unsigned)dc << point_transform); } if (++x == h) { |