diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2023-09-19 01:20:47 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2023-10-03 20:09:27 +0200 |
| commit | 35e6960a6be42ec27de6a3f070071ab7e2e3f27d (patch) | |
| tree | d70648ce3b3ca4edb5e25f169bee6979b0ddd533 /libavcodec/flacdec.c | |
| parent | d11b8bd0c610c212d2a28767f94dc07a8ec473cf (diff) | |
| download | ffmpeg-35e6960a6be42ec27de6a3f070071ab7e2e3f27d.tar.gz | |
avcodec/flacdec: Fix overflow in "33bit" decorrelate
Fixes: signed integer overflow: 538976288 - -9223372036854775808 cannot be represented in type 'long'
Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-6275845531238400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/flacdec.c')
| -rw-r--r-- | libavcodec/flacdec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/flacdec.c b/libavcodec/flacdec.c index 524a046949..0569f019b3 100644 --- a/libavcodec/flacdec.c +++ b/libavcodec/flacdec.c @@ -706,10 +706,10 @@ static void decorrelate_33bps(int ch_mode, int32_t **decoded, int64_t *decoded_3 int i; if (ch_mode == FLAC_CHMODE_LEFT_SIDE ) { for (i = 0; i < len; i++) - decoded[1][i] = decoded[0][i] - decoded_33bps[i]; + decoded[1][i] = decoded[0][i] - (uint64_t)decoded_33bps[i]; } else if (ch_mode == FLAC_CHMODE_RIGHT_SIDE ) { for (i = 0; i < len; i++) - decoded[0][i] = decoded[1][i] + decoded_33bps[i]; + decoded[0][i] = decoded[1][i] + (uint64_t)decoded_33bps[i]; } else if (ch_mode == FLAC_CHMODE_MID_SIDE ) { for (i = 0; i < len; i++) { uint64_t a = decoded[0][i]; |