aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/aacdec_template.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2017-07-14 00:45:29 +0200
committerMichael Niedermayer <michael@niedermayer.cc>2017-07-19 03:54:39 +0200
commita2c3c9bc6038b03af917c7d840ca56d062574ba2 (patch)
tree053dd0c484b326dbb72c71920e7a6ab4c7d8eff4 /libavcodec/aacdec_template.c
parent94077cf6735afd1a166848d388c3a59764e7c71c (diff)
downloadffmpeg-a2c3c9bc6038b03af917c7d840ca56d062574ba2.tar.gz
avcodec/aacdec_template: Fix undefined integer overflow in apply_tns()
Fixes: runtime error: signed integer overflow: -2147483648 - 1202286525 cannot be represented in type 'int' Fixes: 2071/clusterfuzz-testcase-minimized-6036414271586304 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 0ef8f03133a0bd83c74200a8cf30982c0f574016) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/aacdec_template.c')
-rw-r--r--libavcodec/aacdec_template.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/libavcodec/aacdec_template.c b/libavcodec/aacdec_template.c
index a37032a025..996ab638ad 100644
--- a/libavcodec/aacdec_template.c
+++ b/libavcodec/aacdec_template.c
@@ -2363,7 +2363,7 @@ static int decode_extension_payload(AACContext *ac, GetBitContext *gb, int cnt,
* @param decode 1 if tool is used normally, 0 if tool is used in LTP.
* @param coef spectral coefficients
*/
-static void apply_tns(INTFLOAT coef[1024], TemporalNoiseShaping *tns,
+static void apply_tns(INTFLOAT coef_param[1024], TemporalNoiseShaping *tns,
IndividualChannelStream *ics, int decode)
{
const int mmm = FFMIN(ics->tns_max_bands, ics->max_sfb);
@@ -2371,6 +2371,7 @@ static void apply_tns(INTFLOAT coef[1024], TemporalNoiseShaping *tns,
int bottom, top, order, start, end, size, inc;
INTFLOAT lpc[TNS_MAX_ORDER];
INTFLOAT tmp[TNS_MAX_ORDER+1];
+ UINTFLOAT *coef = coef_param;
for (w = 0; w < ics->num_windows; w++) {
bottom = ics->num_swb;
@@ -2400,7 +2401,7 @@ static void apply_tns(INTFLOAT coef[1024], TemporalNoiseShaping *tns,
// ar filter
for (m = 0; m < size; m++, start += inc)
for (i = 1; i <= FFMIN(m, order); i++)
- coef[start] -= AAC_MUL26(coef[start - i * inc], lpc[i - 1]);
+ coef[start] -= AAC_MUL26((INTFLOAT)coef[start - i * inc], lpc[i - 1]);
} else {
// ma filter
for (m = 0; m < size; m++, start += inc) {