wrapper/FFmpeg
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

avcodec/aacsbr_fixed: Fix multiple runtime error: shift exponent 150 is too large for 32-bit type 'int'

Browse source 
Fixes: 1681/clusterfuzz-testcase-minimized-5970545365483520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3fb104f447)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-05-19 12:25:52 +02:00
parent 860ff3c447
commit 3ecff1b7e5
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
libavcodec/aacsbr_fixed.c
View file

@ -291,6 +291,8 @@ static void sbr_hf_inverse_filter(SBRDSPContext *dsp,
shift = a00.exp;
if (shift >= 3)
alpha0[k][0] = 0x7fffffff;
else if (shift <= -30)
alpha0[k][0] = 0;
else {
a00.mant <<= 1;
shift = 2-shift;
@ -305,6 +307,8 @@ static void sbr_hf_inverse_filter(SBRDSPContext *dsp,
shift = a01.exp;
if (shift >= 3)
alpha0[k][1] = 0x7fffffff;
else if (shift <= -30)
alpha0[k][1] = 0;
else {
a01.mant <<= 1;
shift = 2-shift;
@ -318,6 +322,8 @@ static void sbr_hf_inverse_filter(SBRDSPContext *dsp,
shift = a10.exp;
if (shift >= 3)
alpha1[k][0] = 0x7fffffff;
else if (shift <= -30)
alpha1[k][0] = 0;
else {
a10.mant <<= 1;
shift = 2-shift;
@ -332,6 +338,8 @@ static void sbr_hf_inverse_filter(SBRDSPContext *dsp,
shift = a11.exp;
if (shift >= 3)
alpha1[k][1] = 0x7fffffff;
else if (shift <= -30)
alpha1[k][1] = 0;
else {
a11.mant <<= 1;
shift = 2-shift;