diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2024-06-16 01:59:23 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-06-26 20:49:36 +0200 |
| commit | c221c7422f07f2245db5c4cdc958b42ca25eb2b7 (patch) | |
| tree | c119c9fecb7aad851ef5066e0dd2d7d035f78f76 | |
| parent | 9e6c5b6e865a6b1b9c3a471fc06143f11e69d71b (diff) | |
| download | ffmpeg-c221c7422f07f2245db5c4cdc958b42ca25eb2b7.tar.gz | |
swscale/output: Avoid undefined overflow in yuv2rgb_write_full()
Fixes: signed integer overflow: -140140 * 16525 cannot be represented in type 'int'
Fixes: 68859/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-4516387130245120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libswscale/output.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libswscale/output.c b/libswscale/output.c index f9ce43dde8..0e6181b3e0 100644 --- a/libswscale/output.c +++ b/libswscale/output.c @@ -1925,9 +1925,9 @@ static av_always_inline void yuv2rgb_write_full(SwsContext *c, Y -= c->yuv2rgb_y_offset; Y *= c->yuv2rgb_y_coeff; Y += 1 << 21; - R = (unsigned)Y + V*c->yuv2rgb_v2r_coeff; - G = (unsigned)Y + V*c->yuv2rgb_v2g_coeff + U*c->yuv2rgb_u2g_coeff; - B = (unsigned)Y + U*c->yuv2rgb_u2b_coeff; + R = (unsigned)Y + V*(unsigned)c->yuv2rgb_v2r_coeff; + G = (unsigned)Y + V*(unsigned)c->yuv2rgb_v2g_coeff + U*(unsigned)c->yuv2rgb_u2g_coeff; + B = (unsigned)Y + U*(unsigned)c->yuv2rgb_u2b_coeff; if ((R | G | B) & 0xC0000000) { R = av_clip_uintp2(R, 30); G = av_clip_uintp2(G, 30); |