diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2023-07-27 01:59:15 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2023-09-22 23:47:40 +0200 |
| commit | f1954ff8d13b7d72cbdfe9515b7ae130d65bc2b0 (patch) | |
| tree | 6866838e5152cbfa3f4afb326dcf20541e20008a | |
| parent | 9ee87245c5e6eae017430726cce9b4c20d468c2d (diff) | |
| download | ffmpeg-f1954ff8d13b7d72cbdfe9515b7ae130d65bc2b0.tar.gz | |
avcodec/vvc_parser: Avoid undefined overflow in POC computation
The comments to the function say that it does not implement the spec and
instead follows VTM.
This patch is quite likely not the right solution and more intended to show
the issue to people knowing the specific part of VTM ...
Fixes: signed integer overflow: 2147483392 + 256 cannot be represented in type 'int'
Fixes: 60505/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6216675924770816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/vvc_parser.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/vvc_parser.c b/libavcodec/vvc_parser.c index 3951ebe50a..c661595e1e 100644 --- a/libavcodec/vvc_parser.c +++ b/libavcodec/vvc_parser.c @@ -225,10 +225,10 @@ static void get_slice_poc(VVCParserContext *s, int *poc, } else { if ((poc_lsb < prev_poc_lsb) && ((prev_poc_lsb - poc_lsb) >= (max_poc_lsb / 2))) - poc_msb = prev_poc_msb + max_poc_lsb; + poc_msb = prev_poc_msb + (unsigned)max_poc_lsb; else if ((poc_lsb > prev_poc_lsb) && ((poc_lsb - prev_poc_lsb) > (max_poc_lsb / 2))) - poc_msb = prev_poc_msb - max_poc_lsb; + poc_msb = prev_poc_msb - (unsigned)max_poc_lsb; else poc_msb = prev_poc_msb; } |