diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-09-27 17:01:38 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-10-16 19:17:57 +0200 |
| commit | 6a4fdbf112385824fc9b7d7739685359213b579a (patch) | |
| tree | b8b1ad78e7089fc08bd0826208d720015dca07ff /libavcodec | |
| parent | 2b93f52cd635f372b7b22396939e840c63e8edf3 (diff) | |
| download | ffmpeg-6a4fdbf112385824fc9b7d7739685359213b579a.tar.gz | |
avcodec/g729postfilter: Fix undefined shifts
Fixes: left shift of negative value -12
Fixes: 17689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5756275014500352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/g729postfilter.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/libavcodec/g729postfilter.c b/libavcodec/g729postfilter.c index d9076ec735..e8e031a1ed 100644 --- a/libavcodec/g729postfilter.c +++ b/libavcodec/g729postfilter.c @@ -156,7 +156,7 @@ static int16_t long_term_filter(AudioDSPContext *adsp, int pitch_delay_int, sig_scaled[i] = residual[i] >> shift; else for (i = 0; i < subframe_size + RES_PREV_DATA_SIZE; i++) - sig_scaled[i] = residual[i] << -shift; + sig_scaled[i] = (unsigned)residual[i] << -shift; /* Start of best delay searching code */ gain_num = 0; @@ -500,14 +500,14 @@ static int16_t apply_tilt_comp(int16_t* out, int16_t* res_pst, int refl_coeff, tmp = res_pst[subframe_size - 1]; for (i = subframe_size - 1; i >= 1; i--) { - tmp2 = (res_pst[i] << 15) + ((gt * res_pst[i-1]) << 1); - tmp2 = (tmp2 + 0x4000) >> 15; + tmp2 = (gt * res_pst[i-1]) * 2 + 0x4000; + tmp2 = res_pst[i] + (tmp2 >> 15); tmp2 = (tmp2 * ga * 2 + fact) >> sh_fact; out[i] = tmp2; } - tmp2 = (res_pst[0] << 15) + ((gt * ht_prev_data) << 1); - tmp2 = (tmp2 + 0x4000) >> 15; + tmp2 = (gt * ht_prev_data) * 2 + 0x4000; + tmp2 = res_pst[0] + (tmp2 >> 15); tmp2 = (tmp2 * ga * 2 + fact) >> sh_fact; out[0] = tmp2; |