From 3a6e67d2eb4f3a280fca0429dbd799f5667e8b98 Mon Sep 17 00:00:00 2001 From: Ashwin Natesan Date: Wed, 31 Aug 2022 20:30:58 +0530 Subject: [PATCH] mvc: fixed an integer overflow in max_disp_seq computation Bug: 242723830 Test: fuzzer poc in bug Change-Id: I38db0a26317c6ae978b2599cfe989a396a50c0ab --- decoder/mvc/imvcd_utils.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/decoder/mvc/imvcd_utils.c b/decoder/mvc/imvcd_utils.c index d92c50f..5fc1014 100644 --- a/decoder/mvc/imvcd_utils.c +++ b/decoder/mvc/imvcd_utils.c @@ -194,8 +194,9 @@ void imvcd_modulate_max_disp_seq(dec_struct_t *ps_view_ctxt) { WORD64 i8_temp; - i8_temp = ps_view_ctxt->i4_prev_max_display_seq + ps_view_ctxt->i4_max_poc + - ps_view_ctxt->u1_max_dec_frame_buffering + 1; + i8_temp = ((WORD64) ps_view_ctxt->i4_prev_max_display_seq) + + ((WORD64) ps_view_ctxt->i4_max_poc) + + ((WORD64) ps_view_ctxt->u1_max_dec_frame_buffering) + 1ll; ps_view_ctxt->i4_prev_max_display_seq = IS_OUT_OF_RANGE_S32(i8_temp) ? 0 : ((WORD32) i8_temp); ps_view_ctxt->i4_max_poc = 0;