From 2704594292cb2f19cc3683bd9e0426161d55e4c0 Mon Sep 17 00:00:00 2001 From: Ashwin Natesan Date: Sun, 14 Aug 2022 00:13:09 +0530 Subject: [PATCH] mvc: Fixed integer overflow erros while computing picNum Bug: 242372644 Test: fuzzer poc in bug Change-Id: I36b6f7df8804d45e8965a7ef1c69d5a4d4fd835f --- decoder/mvc/imvcd_dpb_manager.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/decoder/mvc/imvcd_dpb_manager.c b/decoder/mvc/imvcd_dpb_manager.c index 7a88d67..5a9cd12 100644 --- a/decoder/mvc/imvcd_dpb_manager.c +++ b/decoder/mvc/imvcd_dpb_manager.c @@ -1877,7 +1877,8 @@ WORD32 imvcd_dpb_do_mmco(dpb_commands_t *ps_dpb_cmds, mvc_dpb_manager_t *ps_dpb_ WORD64 i8_pic_num; u4_diff_pic_num = ps_mmc_params->u4_diff_pic_num; - i8_pic_num = ps_cur_au->i4_pic_num - ((WORD32) (u4_diff_pic_num + 1)); + i8_pic_num = + ((WORD64) ps_cur_au->i4_pic_num) - ((WORD64) (u4_diff_pic_num + 1)); if(IS_OUT_OF_RANGE_S32(i8_pic_num)) { @@ -1930,7 +1931,8 @@ WORD32 imvcd_dpb_do_mmco(dpb_commands_t *ps_dpb_cmds, mvc_dpb_manager_t *ps_dpb_ u4_diff_pic_num = ps_mmc_params->u4_diff_pic_num; - i8_pic_num = ps_cur_au->i4_pic_num - ((WORD32) (u4_diff_pic_num + 1)); + i8_pic_num = + ((WORD64) ps_cur_au->i4_pic_num) - ((WORD64) (u4_diff_pic_num + 1)); if(IS_OUT_OF_RANGE_S32(i8_pic_num)) {