diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-06-15 01:35:49 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-06-22 03:08:23 +0200 |
| commit | fae49f28e6579c0c59ada8c867592fc8411fd65a (patch) | |
| tree | ba228d4de40dd9a3012cd55c7fe4a60ccef37bfa | |
| parent | 628e2b2dd34aeeab6e32f74cc37437c62bc5e013 (diff) | |
| download | ffmpeg-fae49f28e6579c0c59ada8c867592fc8411fd65a.tar.gz | |
avcodec/lpc: signed integer overflow in compute_lpc_coefs() (aacdec_fixed)
Fixes: runtime error: signed integer overflow: -1575818955 + -915383657 cannot be represented in type 'int'
Fixes: 2224/clusterfuzz-testcase-minimized-6208559949807616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e95fcfe8fb28fdfdaecec465c60aad79bc340a3d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/lpc.h | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/libavcodec/lpc.h b/libavcodec/lpc.h index edb1a6bc7d..704ffa9d4b 100644 --- a/libavcodec/lpc.h +++ b/libavcodec/lpc.h @@ -117,11 +117,14 @@ void ff_lpc_end(LPCContext *s); #if USE_FIXED typedef int LPC_TYPE; +typedef unsigned LPC_TYPE_U; #else #ifdef LPC_USE_DOUBLE typedef double LPC_TYPE; +typedef double LPC_TYPE_U; #else typedef float LPC_TYPE; +typedef float LPC_TYPE_U; #endif #endif // USE_FIXED @@ -192,8 +195,8 @@ static inline int AAC_RENAME(compute_lpc_coefs)(const LPC_TYPE *autoc, int max_o for(j=0; j < (i+1)>>1; j++) { LPC_TYPE f = lpc_last[ j]; LPC_TYPE b = lpc_last[i-1-j]; - lpc[ j] = f + AAC_MUL26(r, b); - lpc[i-1-j] = b + AAC_MUL26(r, f); + lpc[ j] = f + (LPC_TYPE_U)AAC_MUL26(r, b); + lpc[i-1-j] = b + (LPC_TYPE_U)AAC_MUL26(r, f); } if (fail && err < 0) |