diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-06-19 21:53:43 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-07-01 12:11:55 +0200 |
| commit | dc94ace7882367fc7b83c35a0633b7b8a475963e (patch) | |
| tree | 2e831e38991a2503f8fdf53a94eb841ec8eeae09 | |
| parent | 5cbd861f0f13334f243046007730aa3f1effea1c (diff) | |
| download | ffmpeg-dc94ace7882367fc7b83c35a0633b7b8a475963e.tar.gz | |
avcodec/alsdec: Fixes invalid shifts in read_var_block_data() and INTERLEAVE_OUTPUT()
Fixes: left shift of negative value -6
Fixes: 15275/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5742361767837696
Fixes: signed integer overflow: 41582592 * 256 cannot be represented in type 'int'
Fixes: 15296/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5739558227935232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e131568752ad41222946304c61eadb87b0a24791)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/alsdec.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c index a9ed2cefda..2ad1470f96 100644 --- a/libavcodec/alsdec.c +++ b/libavcodec/alsdec.c @@ -773,8 +773,8 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) if (*bd->use_ltp) { int r, c; - bd->ltp_gain[0] = decode_rice(gb, 1) << 3; - bd->ltp_gain[1] = decode_rice(gb, 2) << 3; + bd->ltp_gain[0] = decode_rice(gb, 1) * 8; + bd->ltp_gain[1] = decode_rice(gb, 2) * 8; r = get_unary(gb, 0, 4); c = get_bits(gb, 2); @@ -785,8 +785,8 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) bd->ltp_gain[2] = ltp_gain_values[r][c]; - bd->ltp_gain[3] = decode_rice(gb, 2) << 3; - bd->ltp_gain[4] = decode_rice(gb, 1) << 3; + bd->ltp_gain[3] = decode_rice(gb, 2) * 8; + bd->ltp_gain[4] = decode_rice(gb, 1) * 8; *bd->ltp_lag = get_bits(gb, ctx->ltp_lag_length); *bd->ltp_lag += FFMAX(4, opt_order + 1); @@ -1805,11 +1805,11 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame_ptr, if (!ctx->cs_switch) { \ for (sample = 0; sample < ctx->cur_frame_length; sample++) \ for (c = 0; c < avctx->channels; c++) \ - *dest++ = ctx->raw_samples[c][sample] << shift; \ + *dest++ = ctx->raw_samples[c][sample] * (1U << shift); \ } else { \ for (sample = 0; sample < ctx->cur_frame_length; sample++) \ for (c = 0; c < avctx->channels; c++) \ - *dest++ = ctx->raw_samples[sconf->chan_pos[c]][sample] << shift; \ + *dest++ = ctx->raw_samples[sconf->chan_pos[c]][sample] * (1U << shift); \ } \ } |