virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-11-21 10:55:51 +02:00
Code Issues Releases Activity

avcodec/shorten: Fix multiple integer overflows

Browse Source 
Fixes: signed integer overflow: 3 * 1006632960 cannot be represented in type 'int'
Fixes: 8278/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5692857166856192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2018-06-05 13:19:35 +02:00
parent 606c714823
commit f2abd36b38
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/shorten.c
View File

@ -389,7 +389,7 @@ static int decode_subframe_lpc(ShortenContext *s, int command, int channel,
for (i = 0; i < s->blocksize; i++) { for (i = 0; i < s->blocksize; i++) {
sum = init_sum; sum = init_sum;
for (j = 0; j < pred_order; j++) for (j = 0; j < pred_order; j++)
sum += coeffs[j] * s->decoded[channel][i - j - 1]; sum += coeffs[j] * (unsigned)s->decoded[channel][i - j - 1];
s->decoded[channel][i] = get_sr_golomb_shorten(&s->gb, residual_size) + s->decoded[channel][i] = get_sr_golomb_shorten(&s->gb, residual_size) +
(sum >> qshift); (sum >> qshift);
} }
@ -700,7 +700,7 @@ static int shorten_decode_frame(AVCodecContext *avctx, void *data,
/* update means with info from the current block */ /* update means with info from the current block */
if (s->nmean > 0) { if (s->nmean > 0) {
int32_t sum = (s->version < 2) ? 0 : s->blocksize / 2; int64_t sum = (s->version < 2) ? 0 : s->blocksize / 2;
for (i = 0; i < s->blocksize; i++) for (i = 0; i < s->blocksize; i++)
sum += s->decoded[channel][i]; sum += s->decoded[channel][i];