virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-28 20:53:54 +02:00
Code Issues Releases Activity

avcodec/mlp: Fix multiple runtime error: left shift of negative value -1

Browse Source 
Fixes: 1512/clusterfuzz-testcase-minimized-4713846423945216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 74dc728a2c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-05-13 14:39:26 +02:00
parent 906f1f66a8
commit 00a9eaff97
2 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/mlpdec.c
View File

@ -684,7 +684,7 @@ static int read_filter_params(MLPDecodeContext *m, GetBitContext *gbp,
}
for (i = 0; i < order; i++)
fcoeff[i] = get_sbits(gbp, coeff_bits) << coeff_shift;
fcoeff[i] = get_sbits(gbp, coeff_bits) * (1 << coeff_shift);
if (get_bits1(gbp)) {
int state_bits, state_shift;
@ -999,8 +999,8 @@ static void generate_2_noise_channels(MLPDecodeContext *m, unsigned int substr)
for (i = 0; i < s->blockpos; i++) {
uint16_t seed_shr7 = seed >> 7;
m->sample_buffer[i][maxchan+1] = ((int8_t)(seed >> 15)) << s->noise_shift;
m->sample_buffer[i][maxchan+2] = ((int8_t) seed_shr7) << s->noise_shift;
m->sample_buffer[i][maxchan+1] = ((int8_t)(seed >> 15)) * (1 << s->noise_shift);
m->sample_buffer[i][maxchan+2] = ((int8_t) seed_shr7) * (1 << s->noise_shift);
seed = (seed << 16) ^ seed_shr7 ^ (seed_shr7 << 5);
}

4
libavcodec/mlpdsp.c
View File

@ -113,8 +113,8 @@ int32_t ff_mlp_pack_output(int32_t lossless_check_data,
for (i = 0; i < blockpos; i++) {
for (out_ch = 0; out_ch <= max_matrix_channel; out_ch++) {
int mat_ch = ch_assign[out_ch];
int32_t sample = sample_buffer[i][mat_ch]
<< output_shift[mat_ch];
int32_t sample = sample_buffer[i][mat_ch] *
(1 << output_shift[mat_ch]);
lossless_check_data ^= (sample & 0xffffff) << mat_ch;
if (is32)
*data_32++ = sample << 8;