Chiebot-Mirror
/
FFmpeg
mirror of https://github.com/FFmpeg/FFmpeg.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/osq: avoid several signed integer overflows

Browse Source 
Fixes: signed integer overflow: 178459578 + 2009763270 cannot be represented in type 'int'
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-5013423686287360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b54c9a9c8f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
release/6.1
Michael Niedermayer 1 year ago
parent f0c08506f5
commit 21ff582aec
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 12 additions and 12 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 24
      libavcodec/osq.c

24
libavcodec/osq.c
Unescape View File

@ -221,8 +221,8 @@ static int osq_channel_parameters(AVCodecContext *avctx, int ch)
#define C (-3)
#define D (-4)
#define E (-5)
#define P2 ((dst[A] + dst[A]) - dst[B])
#define P3 ((dst[A] - dst[B]) * 3 + dst[C])
#define P2 (((unsigned)dst[A] + dst[A]) - dst[B])
#define P3 (((unsigned)dst[A] - dst[B]) * 3 + dst[C])
static int do_decode(AVCodecContext *avctx, AVFrame *frame, int decorrelate, int downsample)
{
@ -272,10 +272,10 @@ static int do_decode(AVCodecContext *avctx, AVFrame *frame, int decorrelate, int
case 0:
break;
case 1:
dst[n] += dst[A];
dst[n] += (unsigned)dst[A];
break;
case 2:
dst[n] += dst[A] + p;
dst[n] += (unsigned)dst[A] + p;
break;
case 3:
dst[n] += P2;
@ -290,28 +290,28 @@ static int do_decode(AVCodecContext *avctx, AVFrame *frame, int decorrelate, int
dst[n] += P3 + p;
break;
case 7:
dst[n] += (P2 + P3) / 2 + p;
dst[n] += (int)(P2 + P3) / 2 + (unsigned)p;
break;
case 8:
dst[n] += (P2 + P3) / 2;
dst[n] += (int)(P2 + P3) / 2;
break;
case 9:
dst[n] += (P2 * 2 + P3) / 3 + p;
dst[n] += (int)(P2 * 2 + P3) / 3 + (unsigned)p;
break;
case 10:
dst[n] += (P2 + P3 * 2) / 3 + p;
dst[n] += (int)(P2 + P3 * 2) / 3 + (unsigned)p;
break;
case 11:
dst[n] += (dst[A] + dst[B]) / 2;
dst[n] += (int)((unsigned)dst[A] + dst[B]) / 2;
break;
case 12:
dst[n] += dst[B];
dst[n] += (unsigned)dst[B];
break;
case 13:
dst[n] += (dst[D] + dst[B]) / 2;
dst[n] += (int)(unsigned)(dst[D] + dst[B]) / 2;
break;
case 14:
dst[n] += (P2 + dst[A]) / 2 + p;
dst[n] += (int)((unsigned)P2 + dst[A]) / 2 + (unsigned)p;
break;
default:
return AVERROR_INVALIDDATA;

Write Preview
Loading…
Cancel
Save