virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

avcodec/wavarc: Use unsigned for samples in 1dif, 2slp, 5elp

Browse Source 
Fixes: signed integer overflow: 141394472 + 2038060365 cannot be represented in type 'int'
Fixes: 61787/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-5882604925878272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2023-09-09 23:26:35 +02:00
parent b12444fe72
commit 284d1a8a6a
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 14 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
libavcodec/wavarc.c
View File

@ -243,18 +243,18 @@ static int decode_1dif(AVCodecContext *avctx,
break;
case 3:
for (int n = 0; n < s->nb_samples; n++)
samples[n + 4] = get_srice(gb, k) + (samples[n + 3] - samples[n + 2]) * 3 +
samples[n + 4] = get_srice(gb, k) + (samples[n + 3] - (unsigned)samples[n + 2]) * 3 +
samples[n + 1];
finished = 1;
break;
case 2:
for (int n = 0; n < s->nb_samples; n++)
samples[n + 4] = get_srice(gb, k) + (samples[n + 3] * 2 - samples[n + 2]);
samples[n + 4] = get_srice(gb, k) + (samples[n + 3] * 2U - samples[n + 2]);
finished = 1;
break;
case 1:
for (int n = 0; n < s->nb_samples; n++)
samples[n + 4] = get_srice(gb, k) + samples[n + 3];
samples[n + 4] = get_srice(gb, k) + (unsigned)samples[n + 3];
finished = 1;
break;
case 0:
@ -343,13 +343,13 @@ static int decode_2slp(AVCodecContext *avctx,
break;
case 4:
for (int n = 0; n < s->nb_samples; n++)
samples[n + 70] = get_srice(gb, k) + (samples[n + 69] - samples[n + 68]) * 3 +
samples[n + 70] = get_srice(gb, k) + (samples[n + 69] - (unsigned)samples[n + 68]) * 3 +
samples[n + 67];
finished = 1;
break;
case 3:
for (int n = 0; n < s->nb_samples; n++)
samples[n + 70] = get_srice(gb, k) + (samples[n + 69] * 2 - samples[n + 68]);
samples[n + 70] = get_srice(gb, k) + (samples[n + 69] * 2U - samples[n + 68]);
finished = 1;
break;
case 2:
@ -359,7 +359,7 @@ static int decode_2slp(AVCodecContext *avctx,
break;
case 1:
for (int n = 0; n < s->nb_samples; n++)
samples[n + 70] = get_srice(gb, k) + samples[n + 69];
samples[n + 70] = get_srice(gb, k) + (unsigned)samples[n + 69];
finished = 1;
break;
case 0:
@ -630,7 +630,7 @@ static int decode_5elp(AVCodecContext *avctx,
case 20:
case 7:
for (int n = 0; n < s->nb_samples; n++)
samples[n + 70] += ac_out[n] + samples[n + 69] * 3 - samples[n + 68] * 3 + samples[n + 67];
samples[n + 70] += ac_out[n] + samples[n + 69] * 3U - samples[n + 68] * 3U + samples[n + 67];
finished = 1;
break;
case 19:
@ -653,14 +653,14 @@ static int decode_5elp(AVCodecContext *avctx,
samples[n] = ac_pred[n];
for (int n = 0; n < s->nb_samples; n++)
samples[n + 70] += ac_out[n] + samples[n + 69] * 3 - samples[n + 68] * 3 + samples[n + 67];
samples[n + 70] += ac_out[n] + samples[n + 69] * 3U - samples[n + 68] * 3U + samples[n + 67];
finished = 1;
break;
case 18:
case 5:
for (int n = 0; n < s->nb_samples; n++)
samples[n + 70] += ac_out[n] + samples[n + 69] * 2 - samples[n + 68];
samples[n + 70] += ac_out[n] + samples[n + 69] * 2U - samples[n + 68];
finished = 1;
break;
case 17:
@ -672,7 +672,7 @@ static int decode_5elp(AVCodecContext *avctx,
case 16:
case 3:
for (int n = 0; n < s->nb_samples; n++)
samples[n + 70] += ac_out[n] + samples[n + 69];
samples[n + 70] += ac_out[n] + (unsigned)samples[n + 69];
finished = 1;
break;
case 15:
@ -695,7 +695,7 @@ static int decode_5elp(AVCodecContext *avctx,
samples[n] = ac_pred[n];
for (int n = 0; n < s->nb_samples; n++)
samples[n + 70] += samples[n + 69] * 2 - samples[n + 68];
samples[n + 70] += samples[n + 69] * 2U - samples[n + 68];
finished = 1;
break;
@ -712,14 +712,14 @@ static int decode_5elp(AVCodecContext *avctx,
for (int o = 0; o < order; o++)
sum += s->filter[ch][o] * (unsigned)samples[n + 70 - o - 1];
samples[n + 70] += ac_out[n] + (sum >> 4);
samples[n + 70] += (unsigned)ac_out[n] + (sum >> 4);
}
for (int n = 0; n < 70; n++)
samples[n] = ac_pred[n];
for (int n = 0; n < s->nb_samples; n++)
samples[n + 70] += samples[n + 69];
samples[n + 70] += (unsigned)samples[n + 69];
finished = 1;
break;
@ -731,7 +731,7 @@ static int decode_5elp(AVCodecContext *avctx,
for (int o = 0; o < order; o++)
sum += s->filter[ch][o] * (unsigned)samples[n + 70 - o - 1];
samples[n + 70] += ac_out[n] + (sum >> 4);
samples[n + 70] += (unsigned)ac_out[n] + (sum >> 4);
}
finished = 1;
break;