diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2023-03-26 19:49:21 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2023-04-02 23:54:47 +0200 |
| commit | 1942dbb8cab8417838793d9810a21673355f3a9b (patch) | |
| tree | 6012f167844af72dac26693c950869bc9e294efd /libavcodec/wavarc.c | |
| parent | 5f92a192315fc9349e7c9bdc923666f79d5c5e8d (diff) | |
| download | ffmpeg-1942dbb8cab8417838793d9810a21673355f3a9b.tar.gz | |
avcodec/wavarc: Fix several integer overflows
Fixes: signed integer overflow: -532410125 + -1759642300 cannot be represented in type 'int'
Fixes: 57045/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-637023665297817
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/wavarc.c')
| -rw-r--r-- | libavcodec/wavarc.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libavcodec/wavarc.c b/libavcodec/wavarc.c index 8d37af9571..896972cec8 100644 --- a/libavcodec/wavarc.c +++ b/libavcodec/wavarc.c @@ -349,7 +349,7 @@ static int decode_2slp(AVCodecContext *avctx, int sum = 15; for (int o = 0; o < order; o++) - sum += s->filter[ch][o] * samples[n + 70 - o - 1]; + sum += s->filter[ch][o] * (unsigned)samples[n + 70 - o - 1]; samples[n + 70] = get_srice(gb, k) + (sum >> 4); } @@ -452,7 +452,7 @@ fail: const int *src = s->samples[ch] + s->offset; for (int n = 0; n < frame->nb_samples; n++) - dst[n] = src[n] * (1 << s->shift) + 0x80U; + dst[n] = src[n] * (1U << s->shift) + 0x80U; } break; case AV_SAMPLE_FMT_S16P: @@ -461,7 +461,7 @@ fail: const int *src = s->samples[ch] + s->offset; for (int n = 0; n < frame->nb_samples; n++) - dst[n] = src[n] * (1 << s->shift); + dst[n] = src[n] * (1U << s->shift); } break; } |