virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-03-17 20:17:55 +02:00
Code Issues Releases Activity

avcodec/wmalosslessdec: Fix several integer issues

Browse Source 
Fixes: shift exponent -1 is negative (and others)
Fixes: 18852/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5660855295541248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ec3fe67074ad0a6a3a817f6f42175ea63a98092b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-11-18 14:22:57 +01:00
parent 758119ca41
commit daf27acf72
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/wmalosslessdec.c
View File

@ -675,7 +675,7 @@ static void mclms_predict(WmallDecodeCtx *s, int icoef, int *pred)
for (i = 0; i < ich; i++) for (i = 0; i < ich; i++)
pred[ich] += s->channel_residues[i][icoef] * pred[ich] += s->channel_residues[i][icoef] *
s->mclms_coeffs_cur[i + num_channels * ich]; s->mclms_coeffs_cur[i + num_channels * ich];
pred[ich] += 1 << s->mclms_scaling - 1; pred[ich] += (1 << s->mclms_scaling) >> 1;
pred[ich] >>= s->mclms_scaling; pred[ich] >>= s->mclms_scaling;
s->channel_residues[ich][icoef] += pred[ich]; s->channel_residues[ich][icoef] += pred[ich];
} }
@ -803,19 +803,19 @@ static void revert_acfilter(WmallDecodeCtx *s, int tile_size)
pred = 0; pred = 0;
for (j = 0; j < order; j++) { for (j = 0; j < order; j++) {
if (i <= j) if (i <= j)
pred += filter_coeffs[j] * prevvalues[j - i]; pred += (uint32_t)filter_coeffs[j] * prevvalues[j - i];
else else
pred += s->channel_residues[ich][i - j - 1] * filter_coeffs[j]; pred += (uint32_t)s->channel_residues[ich][i - j - 1] * filter_coeffs[j];
} }
pred >>= scaling; pred >>= scaling;
s->channel_residues[ich][i] += pred; s->channel_residues[ich][i] += (unsigned)pred;
} }
for (i = order; i < tile_size; i++) { for (i = order; i < tile_size; i++) {
pred = 0; pred = 0;
for (j = 0; j < order; j++) for (j = 0; j < order; j++)
pred += s->channel_residues[ich][i - j - 1] * filter_coeffs[j]; pred += s->channel_residues[ich][i - j - 1] * filter_coeffs[j];
pred >>= scaling; pred >>= scaling;
s->channel_residues[ich][i] += pred; s->channel_residues[ich][i] += (unsigned)pred;
} }
for (j = 0; j < order; j++) for (j = 0; j < order; j++)
prevvalues[j] = s->channel_residues[ich][tile_size - j - 1]; prevvalues[j] = s->channel_residues[ich][tile_size - j - 1];