summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <[email protected]>2017-05-31 13:21:58 +0200
committerMichael Niedermayer <[email protected]>2017-06-04 00:27:10 +0200
commitf5c5bec448cacf8f8ff85d297be131f2e0680972 (patch)
treeb14f3f85d8433a310f38a7ba62c7a8c206bbccdb
parent794bcc6eca21a4ac64a282a4150036426e641f7b (diff)
avcodec/cavsdec: Fix runtime error: signed integer overflow: 59 + 2147483600 cannot be represented in type 'int'
Fixes: 1903/clusterfuzz-testcase-minimized-5359318167715840 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 58f8cd4ac576028ef492a005bd06b1f22c3a6879) Signed-off-by: Michael Niedermayer <[email protected]>
-rw-r--r--libavcodec/cavsdec.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c
index 4d1b77187b..cd4eec9caf 100644
--- a/libavcodec/cavsdec.c
+++ b/libavcodec/cavsdec.c
@@ -615,7 +615,7 @@ static inline int decode_residual_inter(AVSContext *h)
/* get quantizer */
if (h->cbp && !h->qp_fixed)
- h->qp = (h->qp + get_se_golomb(&h->gb)) & 63;
+ h->qp = (h->qp + (unsigned)get_se_golomb(&h->gb)) & 63;
for (block = 0; block < 4; block++)
if (h->cbp & (1 << block))
decode_residual_block(h, &h->gb, inter_dec, 0, h->qp,