Chiebot-Mirror
/
FFmpeg
mirror of https://github.com/FFmpeg/FFmpeg.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

swscale/output: Fix integer overflow in yuv2rgba64_full_1_c_template()

Browse Source 
Fixes: signed integer overflow: -1082982400 + -1079364728 cannot be represented in type 'int'
Fixes: 67910/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5329011971522560
The input is 9bit in 16bit, the fuzzer fills all 16bit thus generating "invalid" input
No overflow should happen with valid input.

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
release/7.1
Michael Niedermayer 7 months ago
parent a56559e688
commit 1330a73cca
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 8 additions and 8 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 16
      libswscale/output.c

16
libswscale/output.c
Unescape View File

@ -1429,7 +1429,7 @@ yuv2rgba64_full_1_c_template(SwsContext *c, const int32_t *buf0,
if (uvalpha < 2048) { if (uvalpha < 2048) {
for (i = 0; i < dstW; i++) { for (i = 0; i < dstW; i++) {
int Y = (buf0[i]) >> 2; SUINT Y = (buf0[i]) >> 2;
int U = (ubuf0[i] - (128 << 11)) >> 2; int U = (ubuf0[i] - (128 << 11)) >> 2;
int V = (vbuf0[i] - (128 << 11)) >> 2; int V = (vbuf0[i] - (128 << 11)) >> 2;
int R, G, B; int R, G, B;
@ -1448,9 +1448,9 @@ yuv2rgba64_full_1_c_template(SwsContext *c, const int32_t *buf0,
G = V * c->yuv2rgb_v2g_coeff + U * c->yuv2rgb_u2g_coeff; G = V * c->yuv2rgb_v2g_coeff + U * c->yuv2rgb_u2g_coeff;
B = U * c->yuv2rgb_u2b_coeff; B = U * c->yuv2rgb_u2b_coeff;
output_pixel(&dest[0], av_clip_uintp2(((R_B + Y) >> 14) + (1<<15), 16)); output_pixel(&dest[0], av_clip_uintp2(((int)(R_B + Y) >> 14) + (1<<15), 16));
output_pixel(&dest[1], av_clip_uintp2((( G + Y) >> 14) + (1<<15), 16)); output_pixel(&dest[1], av_clip_uintp2(((int)( G + Y) >> 14) + (1<<15), 16));
output_pixel(&dest[2], av_clip_uintp2(((B_R + Y) >> 14) + (1<<15), 16)); output_pixel(&dest[2], av_clip_uintp2(((int)(B_R + Y) >> 14) + (1<<15), 16));
if (eightbytes) { if (eightbytes) {
output_pixel(&dest[3], av_clip_uintp2(A, 30) >> 14); output_pixel(&dest[3], av_clip_uintp2(A, 30) >> 14);
dest += 4; dest += 4;
@ -1462,7 +1462,7 @@ yuv2rgba64_full_1_c_template(SwsContext *c, const int32_t *buf0,
const int32_t *ubuf1 = ubuf[1], *vbuf1 = vbuf[1]; const int32_t *ubuf1 = ubuf[1], *vbuf1 = vbuf[1];
int A = 0xffff<<14; int A = 0xffff<<14;
for (i = 0; i < dstW; i++) { for (i = 0; i < dstW; i++) {
int Y = (buf0[i] ) >> 2; SUINT Y = (buf0[i] ) >> 2;
int U = (ubuf0[i] + ubuf1[i] - (128 << 12)) >> 3; int U = (ubuf0[i] + ubuf1[i] - (128 << 12)) >> 3;
int V = (vbuf0[i] + vbuf1[i] - (128 << 12)) >> 3; int V = (vbuf0[i] + vbuf1[i] - (128 << 12)) >> 3;
int R, G, B; int R, G, B;
@ -1481,9 +1481,9 @@ yuv2rgba64_full_1_c_template(SwsContext *c, const int32_t *buf0,
G = V * c->yuv2rgb_v2g_coeff + U * c->yuv2rgb_u2g_coeff; G = V * c->yuv2rgb_v2g_coeff + U * c->yuv2rgb_u2g_coeff;
B = U * c->yuv2rgb_u2b_coeff; B = U * c->yuv2rgb_u2b_coeff;
output_pixel(&dest[0], av_clip_uintp2(((R_B + Y) >> 14) + (1<<15), 16)); output_pixel(&dest[0], av_clip_uintp2(((int)(R_B + Y) >> 14) + (1<<15), 16));
output_pixel(&dest[1], av_clip_uintp2((( G + Y) >> 14) + (1<<15), 16)); output_pixel(&dest[1], av_clip_uintp2(((int)( G + Y) >> 14) + (1<<15), 16));
output_pixel(&dest[2], av_clip_uintp2(((B_R + Y) >> 14) + (1<<15), 16)); output_pixel(&dest[2], av_clip_uintp2(((int)(B_R + Y) >> 14) + (1<<15), 16));
if (eightbytes) { if (eightbytes) {
output_pixel(&dest[3], av_clip_uintp2(A, 30) >> 14); output_pixel(&dest[3], av_clip_uintp2(A, 30) >> 14);
dest += 4; dest += 4;

Write Preview
Loading…
Cancel
Save