Chiebot-Mirror
/
FFmpeg
mirror of https://github.com/FFmpeg/FFmpeg.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/mdct_*: Fix integer overflow in addition in RESCALE()

Browse Source 
Fixes: runtime error: signed integer overflow: 1219998458 - -1469874012 cannot be represented in type 'int'
Fixes: 3443/clusterfuzz-testcase-minimized-5369987105554432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
pull/272/head
Michael Niedermayer 7 years ago
parent c897a92858
commit 770c934fa1
2 changed files with 11 additions and 11 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 8
      libavcodec/mdct_fixed.c
  2. 14
      libavcodec/mdct_template.c

8
libavcodec/mdct_fixed.c
Unescape View File

@ -39,13 +39,13 @@ void ff_mdct_calcw_c(FFTContext *s, FFTDouble *out, const FFTSample *input)
/* pre rotation */
for(i=0;i<n8;i++) {
re = RSCALE(-input[2*i+n3] - input[n3-1-2*i]);
im = RSCALE(-input[n4+2*i] + input[n4-1-2*i]);
re = RSCALE(-input[2*i+n3], - input[n3-1-2*i]);
im = RSCALE(-input[n4+2*i], + input[n4-1-2*i]);
j = revtab[i];
CMUL(x[j].re, x[j].im, re, im, -tcos[i], tsin[i]);
re = RSCALE( input[2*i] - input[n2-1-2*i]);
im = RSCALE(-input[n2+2*i] - input[ n-1-2*i]);
re = RSCALE( input[2*i] , - input[n2-1-2*i]);
im = RSCALE(-input[n2+2*i], - input[ n-1-2*i]);
j = revtab[n8 + i];
CMUL(x[j].re, x[j].im, re, im, -tcos[n8 + i], tsin[n8 + i]);
}

14
libavcodec/mdct_template.c
Unescape View File

@ -33,12 +33,12 @@
*/
#if FFT_FLOAT
# define RSCALE(x) (x)
# define RSCALE(x, y) ((x) + (y))
#else
#if FFT_FIXED_32
# define RSCALE(x) (((x) + 32) >> 6)
# define RSCALE(x, y) ((int)((x) + (unsigned)(y) + 32) >> 6)
#else /* FFT_FIXED_32 */
# define RSCALE(x) ((x) >> 1)
# define RSCALE(x, y) ((int)((x) + (unsigned)(y)) >> 1)
#endif /* FFT_FIXED_32 */
#endif
@ -181,13 +181,13 @@ void ff_mdct_calc_c(FFTContext *s, FFTSample *out, const FFTSample *input)
/* pre rotation */
for(i=0;i<n8;i++) {
re = RSCALE(-input[2*i+n3] - input[n3-1-2*i]);
im = RSCALE(-input[n4+2*i] + input[n4-1-2*i]);
re = RSCALE(-input[2*i+n3], - input[n3-1-2*i]);
im = RSCALE(-input[n4+2*i], + input[n4-1-2*i]);
j = revtab[i];
CMUL(x[j].re, x[j].im, re, im, -tcos[i], tsin[i]);
re = RSCALE( input[2*i] - input[n2-1-2*i]);
im = RSCALE(-input[n2+2*i] - input[ n-1-2*i]);
re = RSCALE( input[2*i] , - input[n2-1-2*i]);
im = RSCALE(-input[n2+2*i], - input[ n-1-2*i]);
j = revtab[n8 + i];
CMUL(x[j].re, x[j].im, re, im, -tcos[n8 + i], tsin[n8 + i]);
}

Write Preview
Loading…
Cancel
Save