virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-11-21 10:55:51 +02:00
Code Issues Releases Activity

avcodec/mv30: Fix integer overflows in idct2_1d()

Browse Source 
Fixes: signed integer overflow: 6500736 * 473 cannot be represented in type 'int'
Fixes: 23259/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MV30_fuzzer-5179394271477760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2020-06-18 11:52:47 +02:00
parent 2d96c94531
commit 3b8d5bcc31
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/mv30.c
View File

@ -200,10 +200,10 @@ static inline void idct2_1d(int *blk, int step)
{ {
const int t0 = blk[0 * step]; const int t0 = blk[0 * step];
const int t1 = blk[1 * step]; const int t1 = blk[1 * step];
const int t2 = t1 * 473 >> 8; const int t2 = (int)(t1 * 473U) >> 8;
const int t3 = t2 - t1; const int t3 = t2 - t1;
const int t4 = (t1 * 362 >> 8) - t3; const int t4 = ((int)(t1 * 362U) >> 8) - t3;
const int t5 = ((t1 * 277 >> 8) - t2) + t4; const int t5 = (((int)(t1 * 277U) >> 8) - t2) + t4;
blk[0 * step] = t1 + t0; blk[0 * step] = t1 + t0;
blk[1 * step] = t0 + t3; blk[1 * step] = t0 + t3;