diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-07-14 00:45:29 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-07-19 03:54:39 +0200 |
| commit | 5e78e477fa6902092774a80c14118b9d98568fc4 (patch) | |
| tree | 396fde116b8c4e41a6a395b1bde19341948aa7ae /libavcodec/aacdec_template.c | |
| parent | 9a2ca3cce2cfb74ffdf9fc27405aac24e042df96 (diff) | |
| download | ffmpeg-5e78e477fa6902092774a80c14118b9d98568fc4.tar.gz | |
avcodec/aacdec_template: Fix undefined integer overflow in apply_tns()
Fixes: runtime error: signed integer overflow: -2147483648 - 1202286525 cannot be represented in type 'int'
Fixes: 2071/clusterfuzz-testcase-minimized-6036414271586304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ef8f03133a0bd83c74200a8cf30982c0f574016)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/aacdec_template.c')
| -rw-r--r-- | libavcodec/aacdec_template.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/libavcodec/aacdec_template.c b/libavcodec/aacdec_template.c index ded9e464a7..b04e595304 100644 --- a/libavcodec/aacdec_template.c +++ b/libavcodec/aacdec_template.c @@ -2363,7 +2363,7 @@ static int decode_extension_payload(AACContext *ac, GetBitContext *gb, int cnt, * @param decode 1 if tool is used normally, 0 if tool is used in LTP. * @param coef spectral coefficients */ -static void apply_tns(INTFLOAT coef[1024], TemporalNoiseShaping *tns, +static void apply_tns(INTFLOAT coef_param[1024], TemporalNoiseShaping *tns, IndividualChannelStream *ics, int decode) { const int mmm = FFMIN(ics->tns_max_bands, ics->max_sfb); @@ -2371,6 +2371,7 @@ static void apply_tns(INTFLOAT coef[1024], TemporalNoiseShaping *tns, int bottom, top, order, start, end, size, inc; INTFLOAT lpc[TNS_MAX_ORDER]; INTFLOAT tmp[TNS_MAX_ORDER+1]; + UINTFLOAT *coef = coef_param; for (w = 0; w < ics->num_windows; w++) { bottom = ics->num_swb; @@ -2400,7 +2401,7 @@ static void apply_tns(INTFLOAT coef[1024], TemporalNoiseShaping *tns, // ar filter for (m = 0; m < size; m++, start += inc) for (i = 1; i <= FFMIN(m, order); i++) - coef[start] -= AAC_MUL26(coef[start - i * inc], lpc[i - 1]); + coef[start] -= AAC_MUL26((INTFLOAT)coef[start - i * inc], lpc[i - 1]); } else { // ma filter for (m = 0; m < size; m++, start += inc) { |