virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-07-11 14:30:22 +02:00
Code Issues Releases Activity

avcodec/h264idct_template: Fix integer overflow in ff_h264_idct_add()

Browse Source 
Fixes: runtime error: signed integer overflow: 26215360 + 2121330944 cannot be represented in type 'int'
Fixes: 2809/clusterfuzz-testcase-minimized-4785181833560064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
This commit is contained in:
Michael Niedermayer
2017-08-01 19:56:07 +02:00
parent 50aeb6e4ed
commit d1bfa80ec4
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/h264idct_template.c
View File

@ -40,10 +40,10 @@ void FUNCC(ff_h264_idct_add)(uint8_t *_dst, int16_t *_block, int stride)
block[0] += 1 << 5; block[0] += 1 << 5;
for(i=0; i<4; i++){ for(i=0; i<4; i++){
const SUINT z0= block[i + 4*0] + block[i + 4*2]; const SUINT z0= block[i + 4*0] + (unsigned)block[i + 4*2];
const SUINT z1= block[i + 4*0] - block[i + 4*2]; const SUINT z1= block[i + 4*0] - (unsigned)block[i + 4*2];
const SUINT z2= (block[i + 4*1]>>1) - block[i + 4*3]; const SUINT z2= (block[i + 4*1]>>1) - (unsigned)block[i + 4*3];
const SUINT z3= block[i + 4*1] + (block[i + 4*3]>>1); const SUINT z3= block[i + 4*1] + (unsigned)(block[i + 4*3]>>1);
block[i + 4*0]= z0 + z3; block[i + 4*0]= z0 + z3;
block[i + 4*1]= z1 + z2; block[i + 4*1]= z1 + z2;