Chiebot-Mirror
/
FFmpeg
mirror of https://github.com/FFmpeg/FFmpeg.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/wavpack: Fix multiple runtime error: signed integer overflow: 548 * -2147483648 cannot be represented in type 'int'

Browse Source 
Fixes: 1659/clusterfuzz-testcase-minimized-5396490639900672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
pull/28/merge
Michael Niedermayer 8 years ago
parent c3547dcbc3
commit 3b09d7c264
1 changed files with 6 additions and 6 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 12
      libavcodec/wavpack.c

12
libavcodec/wavpack.c
Unescape View File

@ -433,8 +433,8 @@ static inline int wv_unpack_stereo(WavpackFrameContext *s, GetBitContext *gb,
L2 = L + ((s->decorr[i].weightA * (int64_t)A + 512) >> 10); L2 = L + ((s->decorr[i].weightA * (int64_t)A + 512) >> 10);
R2 = R + ((s->decorr[i].weightB * (int64_t)B + 512) >> 10); R2 = R + ((s->decorr[i].weightB * (int64_t)B + 512) >> 10);
} else { } else {
L2 = L + ((int)(s->decorr[i].weightA * A + 512U) >> 10); L2 = L + ((int)(s->decorr[i].weightA * (unsigned)A + 512) >> 10);
R2 = R + ((int)(s->decorr[i].weightB * B + 512U) >> 10); R2 = R + ((int)(s->decorr[i].weightB * (unsigned)B + 512) >> 10);
} }
if (A && L) if (A && L)
s->decorr[i].weightA -= ((((L ^ A) >> 30) & 2) - 1) * s->decorr[i].delta; s->decorr[i].weightA -= ((((L ^ A) >> 30) & 2) - 1) * s->decorr[i].delta;
@ -446,13 +446,13 @@ static inline int wv_unpack_stereo(WavpackFrameContext *s, GetBitContext *gb,
if (type != AV_SAMPLE_FMT_S16P) if (type != AV_SAMPLE_FMT_S16P)
L2 = L + ((s->decorr[i].weightA * (int64_t)s->decorr[i].samplesA[0] + 512) >> 10); L2 = L + ((s->decorr[i].weightA * (int64_t)s->decorr[i].samplesA[0] + 512) >> 10);
else else
L2 = L + ((s->decorr[i].weightA * s->decorr[i].samplesA[0] + 512) >> 10); L2 = L + ((int)(s->decorr[i].weightA * (unsigned)s->decorr[i].samplesA[0] + 512) >> 10);
UPDATE_WEIGHT_CLIP(s->decorr[i].weightA, s->decorr[i].delta, s->decorr[i].samplesA[0], L); UPDATE_WEIGHT_CLIP(s->decorr[i].weightA, s->decorr[i].delta, s->decorr[i].samplesA[0], L);
L = L2; L = L2;
if (type != AV_SAMPLE_FMT_S16P) if (type != AV_SAMPLE_FMT_S16P)
R2 = R + ((s->decorr[i].weightB * (int64_t)L2 + 512) >> 10); R2 = R + ((s->decorr[i].weightB * (int64_t)L2 + 512) >> 10);
else else
R2 = R + ((s->decorr[i].weightB * L2 + 512) >> 10); R2 = R + ((int)(s->decorr[i].weightB * (unsigned)L2 + 512) >> 10);
UPDATE_WEIGHT_CLIP(s->decorr[i].weightB, s->decorr[i].delta, L2, R); UPDATE_WEIGHT_CLIP(s->decorr[i].weightB, s->decorr[i].delta, L2, R);
R = R2; R = R2;
s->decorr[i].samplesA[0] = R; s->decorr[i].samplesA[0] = R;
@ -460,7 +460,7 @@ static inline int wv_unpack_stereo(WavpackFrameContext *s, GetBitContext *gb,
if (type != AV_SAMPLE_FMT_S16P) if (type != AV_SAMPLE_FMT_S16P)
R2 = R + ((s->decorr[i].weightB * (int64_t)s->decorr[i].samplesB[0] + 512) >> 10); R2 = R + ((s->decorr[i].weightB * (int64_t)s->decorr[i].samplesB[0] + 512) >> 10);
else else
R2 = R + ((s->decorr[i].weightB * s->decorr[i].samplesB[0] + 512) >> 10); R2 = R + ((int)(s->decorr[i].weightB * (unsigned)s->decorr[i].samplesB[0] + 512) >> 10);
UPDATE_WEIGHT_CLIP(s->decorr[i].weightB, s->decorr[i].delta, s->decorr[i].samplesB[0], R); UPDATE_WEIGHT_CLIP(s->decorr[i].weightB, s->decorr[i].delta, s->decorr[i].samplesB[0], R);
R = R2; R = R2;
@ -472,7 +472,7 @@ static inline int wv_unpack_stereo(WavpackFrameContext *s, GetBitContext *gb,
if (type != AV_SAMPLE_FMT_S16P) if (type != AV_SAMPLE_FMT_S16P)
L2 = L + ((s->decorr[i].weightA * (int64_t)R2 + 512) >> 10); L2 = L + ((s->decorr[i].weightA * (int64_t)R2 + 512) >> 10);
else else
L2 = L + ((s->decorr[i].weightA * R2 + 512) >> 10); L2 = L + ((int)(s->decorr[i].weightA * (unsigned)R2 + 512) >> 10);
UPDATE_WEIGHT_CLIP(s->decorr[i].weightA, s->decorr[i].delta, R2, L); UPDATE_WEIGHT_CLIP(s->decorr[i].weightA, s->decorr[i].delta, R2, L);
L = L2; L = L2;
s->decorr[i].samplesB[0] = L; s->decorr[i].samplesB[0] = L;

Write Preview
Loading…
Cancel
Save