Chiebot-Mirror
/
FFmpeg
mirror of https://github.com/FFmpeg/FFmpeg.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/wavarc: Use unsigned for samples in 1dif, 2slp, 5elp

Browse Source 
Fixes: signed integer overflow: 141394472 + 2038060365 cannot be represented in type 'int'
Fixes: 61787/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-5882604925878272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
pull/390/head
Michael Niedermayer 1 year ago
parent b12444fe72
commit 284d1a8a6a
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 14 additions and 14 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 28
      libavcodec/wavarc.c

28
libavcodec/wavarc.c
Unescape View File

@ -243,18 +243,18 @@ static int decode_1dif(AVCodecContext *avctx,
break;
case 3:
for (int n = 0; n < s->nb_samples; n++)
samples[n + 4] = get_srice(gb, k) + (samples[n + 3] - samples[n + 2]) * 3 +
samples[n + 4] = get_srice(gb, k) + (samples[n + 3] - (unsigned)samples[n + 2]) * 3 +
samples[n + 1];
finished = 1;
break;
case 2:
for (int n = 0; n < s->nb_samples; n++)
samples[n + 4] = get_srice(gb, k) + (samples[n + 3] * 2 - samples[n + 2]);
samples[n + 4] = get_srice(gb, k) + (samples[n + 3] * 2U - samples[n + 2]);
finished = 1;
break;
case 1:
for (int n = 0; n < s->nb_samples; n++)
samples[n + 4] = get_srice(gb, k) + samples[n + 3];
samples[n + 4] = get_srice(gb, k) + (unsigned)samples[n + 3];
finished = 1;
break;
case 0:
@ -343,13 +343,13 @@ static int decode_2slp(AVCodecContext *avctx,
break;
case 4:
for (int n = 0; n < s->nb_samples; n++)
samples[n + 70] = get_srice(gb, k) + (samples[n + 69] - samples[n + 68]) * 3 +
samples[n + 70] = get_srice(gb, k) + (samples[n + 69] - (unsigned)samples[n + 68]) * 3 +
samples[n + 67];
finished = 1;
break;
case 3:
for (int n = 0; n < s->nb_samples; n++)
samples[n + 70] = get_srice(gb, k) + (samples[n + 69] * 2 - samples[n + 68]);
samples[n + 70] = get_srice(gb, k) + (samples[n + 69] * 2U - samples[n + 68]);
finished = 1;
break;
case 2:
@ -359,7 +359,7 @@ static int decode_2slp(AVCodecContext *avctx,
break;
case 1:
for (int n = 0; n < s->nb_samples; n++)
samples[n + 70] = get_srice(gb, k) + samples[n + 69];
samples[n + 70] = get_srice(gb, k) + (unsigned)samples[n + 69];
finished = 1;
break;
case 0:
@ -630,7 +630,7 @@ static int decode_5elp(AVCodecContext *avctx,
case 20:
case 7:
for (int n = 0; n < s->nb_samples; n++)
samples[n + 70] += ac_out[n] + samples[n + 69] * 3 - samples[n + 68] * 3 + samples[n + 67];
samples[n + 70] += ac_out[n] + samples[n + 69] * 3U - samples[n + 68] * 3U + samples[n + 67];
finished = 1;
break;
case 19:
@ -653,14 +653,14 @@ static int decode_5elp(AVCodecContext *avctx,
samples[n] = ac_pred[n];
for (int n = 0; n < s->nb_samples; n++)
samples[n + 70] += ac_out[n] + samples[n + 69] * 3 - samples[n + 68] * 3 + samples[n + 67];
samples[n + 70] += ac_out[n] + samples[n + 69] * 3U - samples[n + 68] * 3U + samples[n + 67];
finished = 1;
break;
case 18:
case 5:
for (int n = 0; n < s->nb_samples; n++)
samples[n + 70] += ac_out[n] + samples[n + 69] * 2 - samples[n + 68];
samples[n + 70] += ac_out[n] + samples[n + 69] * 2U - samples[n + 68];
finished = 1;
break;
case 17:
@ -672,7 +672,7 @@ static int decode_5elp(AVCodecContext *avctx,
case 16:
case 3:
for (int n = 0; n < s->nb_samples; n++)
samples[n + 70] += ac_out[n] + samples[n + 69];
samples[n + 70] += ac_out[n] + (unsigned)samples[n + 69];
finished = 1;
break;
case 15:
@ -695,7 +695,7 @@ static int decode_5elp(AVCodecContext *avctx,
samples[n] = ac_pred[n];
for (int n = 0; n < s->nb_samples; n++)
samples[n + 70] += samples[n + 69] * 2 - samples[n + 68];
samples[n + 70] += samples[n + 69] * 2U - samples[n + 68];
finished = 1;
break;
@ -712,14 +712,14 @@ static int decode_5elp(AVCodecContext *avctx,
for (int o = 0; o < order; o++)
sum += s->filter[ch][o] * (unsigned)samples[n + 70 - o - 1];
samples[n + 70] += ac_out[n] + (sum >> 4);
samples[n + 70] += (unsigned)ac_out[n] + (sum >> 4);
}
for (int n = 0; n < 70; n++)
samples[n] = ac_pred[n];
for (int n = 0; n < s->nb_samples; n++)
samples[n + 70] += samples[n + 69];
samples[n + 70] += (unsigned)samples[n + 69];
finished = 1;
break;
@ -731,7 +731,7 @@ static int decode_5elp(AVCodecContext *avctx,
for (int o = 0; o < order; o++)
sum += s->filter[ch][o] * (unsigned)samples[n + 70 - o - 1];
samples[n + 70] += ac_out[n] + (sum >> 4);
samples[n + 70] += (unsigned)ac_out[n] + (sum >> 4);
}
finished = 1;
break;

Write Preview
Loading…
Cancel
Save