diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-10-19 21:27:41 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-12-06 20:30:58 +0100 |
| commit | 98510f3c8482bb36b52cf3327c208449b8ec2039 (patch) | |
| tree | 9066e26c638b1bdb773d6cabbeed3148441a3387 | |
| parent | 1e57ce1dd5a154454a7099528deeb4e5f9d70472 (diff) | |
| download | ffmpeg-98510f3c8482bb36b52cf3327c208449b8ec2039.tar.gz | |
avutil/lfg: Correct index increment type to avoid undefined behavior
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 18333/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COMFORTNOISE_fuzzer-5668481831272448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6014bcf1b74e903f535461ade4aa5fb44dbf5d8b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavutil/lfg.h | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/libavutil/lfg.h b/libavutil/lfg.h index ec90562cf2..afd6f4ab8e 100644 --- a/libavutil/lfg.h +++ b/libavutil/lfg.h @@ -36,8 +36,9 @@ void av_lfg_init(AVLFG *c, unsigned int seed); * it may be good enough and faster for your specific use case. */ static inline unsigned int av_lfg_get(AVLFG *c){ - c->state[c->index & 63] = c->state[(c->index-24) & 63] + c->state[(c->index-55) & 63]; - return c->state[c->index++ & 63]; + unsigned a = c->state[c->index & 63] = c->state[(c->index-24) & 63] + c->state[(c->index-55) & 63]; + c->index += 1U; + return a; } /** @@ -48,7 +49,9 @@ static inline unsigned int av_lfg_get(AVLFG *c){ static inline unsigned int av_mlfg_get(AVLFG *c){ unsigned int a= c->state[(c->index-55) & 63]; unsigned int b= c->state[(c->index-24) & 63]; - return c->state[c->index++ & 63] = 2*a*b+a+b; + a = c->state[c->index & 63] = 2*a*b+a+b; + c->index += 1U; + return a; } /** |