wrapper/FFmpeg
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

avcodec/aacdec_fixed: Fix runtime error: left shift of negative value -1

Browse source 
Fixes: 1535/clusterfuzz-testcase-minimized-5826695535788032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 26227d9186)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-05-13 18:13:48 +02:00
parent 128b42f4d1
commit b0f3f56bbc
1 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
libavcodec/aacdec_fixed.c
View file

@ -125,7 +125,7 @@ static inline int *DEC_SQUAD(int *dst, unsigned idx)
static inline int *DEC_UPAIR(int *dst, unsigned idx, unsigned sign)
{
dst[0] = (idx & 15) * (1 - (sign & 0xFFFFFFFE));
dst[1] = (idx >> 4 & 15) * (1 - ((sign & 1) << 1));
dst[1] = (idx >> 4 & 15) * (1 - ((sign & 1) * 2));
return dst + 2;
}
@ -134,16 +134,16 @@ static inline int *DEC_UQUAD(int *dst, unsigned idx, unsigned sign)
{
unsigned nz = idx >> 12;
dst[0] = (idx & 3) * (1 + (((int)sign >> 31) << 1));
dst[0] = (idx & 3) * (1 + (((int)sign >> 31) * 2));
sign <<= nz & 1;
nz >>= 1;
dst[1] = (idx >> 2 & 3) * (1 + (((int)sign >> 31) << 1));
dst[1] = (idx >> 2 & 3) * (1 + (((int)sign >> 31) * 2));
sign <<= nz & 1;
nz >>= 1;
dst[2] = (idx >> 4 & 3) * (1 + (((int)sign >> 31) << 1));
dst[2] = (idx >> 4 & 3) * (1 + (((int)sign >> 31) * 2));
sign <<= nz & 1;
nz >>= 1;
dst[3] = (idx >> 6 & 3) * (1 + (((int)sign >> 31) << 1));
dst[3] = (idx >> 6 & 3) * (1 + (((int)sign >> 31) * 2));
return dst + 4;
}