diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-06-26 00:23:47 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-07-08 09:38:05 +0200 |
| commit | 85cbd042ff801b4c4e13fca637d2dd25b7a312ff (patch) | |
| tree | e8547dbb6fbc326b25b1db2ae937da6d4d407c87 /libavcodec/simple_idct_template.c | |
| parent | b5f2cfd2ad2b269d3de79083dbb9162a632b69bb (diff) | |
| download | ffmpeg-85cbd042ff801b4c4e13fca637d2dd25b7a312ff.tar.gz | |
avcodec/simple_idct_template: Fix integer overflow in idctSparseColAdd()
Fixes: signed integer overflow: 1106434976 + 1041773512 cannot be represented in type 'int'
Fixes: 15421/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV2_fuzzer-5669209314426880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/simple_idct_template.c')
| -rw-r--r-- | libavcodec/simple_idct_template.c | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/libavcodec/simple_idct_template.c b/libavcodec/simple_idct_template.c index 90d1c21355..d8fcfd7c53 100644 --- a/libavcodec/simple_idct_template.c +++ b/libavcodec/simple_idct_template.c @@ -288,25 +288,25 @@ static inline void FUNC6(idctSparseColPut)(pixel *dest, ptrdiff_t line_size, static inline void FUNC6(idctSparseColAdd)(pixel *dest, ptrdiff_t line_size, idctin *col) { - int a0, a1, a2, a3, b0, b1, b2, b3; + unsigned a0, a1, a2, a3, b0, b1, b2, b3; IDCT_COLS; - dest[0] = av_clip_pixel(dest[0] + ((a0 + b0) >> COL_SHIFT)); + dest[0] = av_clip_pixel(dest[0] + ((int)(a0 + b0) >> COL_SHIFT)); dest += line_size; - dest[0] = av_clip_pixel(dest[0] + ((a1 + b1) >> COL_SHIFT)); + dest[0] = av_clip_pixel(dest[0] + ((int)(a1 + b1) >> COL_SHIFT)); dest += line_size; - dest[0] = av_clip_pixel(dest[0] + ((a2 + b2) >> COL_SHIFT)); + dest[0] = av_clip_pixel(dest[0] + ((int)(a2 + b2) >> COL_SHIFT)); dest += line_size; - dest[0] = av_clip_pixel(dest[0] + ((a3 + b3) >> COL_SHIFT)); + dest[0] = av_clip_pixel(dest[0] + ((int)(a3 + b3) >> COL_SHIFT)); dest += line_size; - dest[0] = av_clip_pixel(dest[0] + ((a3 - b3) >> COL_SHIFT)); + dest[0] = av_clip_pixel(dest[0] + ((int)(a3 - b3) >> COL_SHIFT)); dest += line_size; - dest[0] = av_clip_pixel(dest[0] + ((a2 - b2) >> COL_SHIFT)); + dest[0] = av_clip_pixel(dest[0] + ((int)(a2 - b2) >> COL_SHIFT)); dest += line_size; - dest[0] = av_clip_pixel(dest[0] + ((a1 - b1) >> COL_SHIFT)); + dest[0] = av_clip_pixel(dest[0] + ((int)(a1 - b1) >> COL_SHIFT)); dest += line_size; - dest[0] = av_clip_pixel(dest[0] + ((a0 - b0) >> COL_SHIFT)); + dest[0] = av_clip_pixel(dest[0] + ((int)(a0 - b0) >> COL_SHIFT)); } static inline void FUNC6(idctSparseCol)(idctin *col) |