wrapper/FFmpeg
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

avcodec/wavarc: Fix several integer overflows

Browse source 
Fixes: signed integer overflow: -532410125 + -1759642300 cannot be represented in type 'int'
Fixes: 57045/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-637023665297817

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1942dbb8ca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2023-03-26 19:49:21 +02:00
parent deeb0b6e94
commit b89cda3269
No known key found for this signature in database
GPG key ID: B18E8928B3948D64
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
libavcodec/wavarc.c
View file

@ -349,7 +349,7 @@ static int decode_2slp(AVCodecContext *avctx,
int sum = 15;
for (int o = 0; o < order; o++)
sum += s->filter[ch][o] * samples[n + 70 - o - 1];
sum += s->filter[ch][o] * (unsigned)samples[n + 70 - o - 1];
samples[n + 70] = get_srice(gb, k) + (sum >> 4);
}
@ -452,7 +452,7 @@ fail:
const int *src = s->samples[ch] + s->offset;
for (int n = 0; n < frame->nb_samples; n++)
dst[n] = src[n] * (1 << s->shift) + 0x80U;
dst[n] = src[n] * (1U << s->shift) + 0x80U;
}
break;
case AV_SAMPLE_FMT_S16P:
@ -461,7 +461,7 @@ fail:
const int *src = s->samples[ch] + s->offset;
for (int n = 0; n < frame->nb_samples; n++)
dst[n] = src[n] * (1 << s->shift);
dst[n] = src[n] * (1U << s->shift);
}
break;
}