virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-19 05:49:09 +02:00
Code Issues Releases Activity

avcodec/g729postfilter: Fix undefined shifts

Browse Source 
Fixes: left shift of negative value -12
Fixes: 17689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5756275014500352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6a4fdbf112385824fc9b7d7739685359213b579a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-09-27 17:01:38 +02:00
parent b977836eda
commit 45e31d6dd0
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/g729postfilter.c
View File

@ -156,7 +156,7 @@ static int16_t long_term_filter(AudioDSPContext *adsp, int pitch_delay_int,
sig_scaled[i] = residual[i] >> shift; sig_scaled[i] = residual[i] >> shift;
else else
for (i = 0; i < subframe_size + RES_PREV_DATA_SIZE; i++) for (i = 0; i < subframe_size + RES_PREV_DATA_SIZE; i++)
sig_scaled[i] = residual[i] << -shift; sig_scaled[i] = (unsigned)residual[i] << -shift;
/* Start of best delay searching code */ /* Start of best delay searching code */
gain_num = 0; gain_num = 0;
@ -500,14 +500,14 @@ static int16_t apply_tilt_comp(int16_t* out, int16_t* res_pst, int refl_coeff,
tmp = res_pst[subframe_size - 1]; tmp = res_pst[subframe_size - 1];
for (i = subframe_size - 1; i >= 1; i--) { for (i = subframe_size - 1; i >= 1; i--) {
tmp2 = (res_pst[i] << 15) + ((gt * res_pst[i-1]) << 1); tmp2 = (gt * res_pst[i-1]) * 2 + 0x4000;
tmp2 = (tmp2 + 0x4000) >> 15; tmp2 = res_pst[i] + (tmp2 >> 15);
tmp2 = (tmp2 * ga * 2 + fact) >> sh_fact; tmp2 = (tmp2 * ga * 2 + fact) >> sh_fact;
out[i] = tmp2; out[i] = tmp2;
} }
tmp2 = (res_pst[0] << 15) + ((gt * ht_prev_data) << 1); tmp2 = (gt * ht_prev_data) * 2 + 0x4000;
tmp2 = (tmp2 + 0x4000) >> 15; tmp2 = res_pst[0] + (tmp2 >> 15);
tmp2 = (tmp2 * ga * 2 + fact) >> sh_fact; tmp2 = (tmp2 * ga * 2 + fact) >> sh_fact;
out[0] = tmp2; out[0] = tmp2;