Chiebot-Mirror
/
FFmpeg
mirror of https://github.com/FFmpeg/FFmpeg.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/simple_idct_template: Fix integer overflow in idctSparseColAdd()

Browse Source 
Fixes: signed integer overflow: 1106434976 + 1041773512 cannot be represented in type 'int'
Fixes: 15421/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV2_fuzzer-5669209314426880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
pull/316/head
Michael Niedermayer 6 years ago
parent b5f2cfd2ad
commit 85cbd042ff
1 changed files with 9 additions and 9 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 18
      libavcodec/simple_idct_template.c

18
libavcodec/simple_idct_template.c
Unescape View File

@ -288,25 +288,25 @@ static inline void FUNC6(idctSparseColPut)(pixel *dest, ptrdiff_t line_size,
static inline void FUNC6(idctSparseColAdd)(pixel *dest, ptrdiff_t line_size,
idctin *col)
{
int a0, a1, a2, a3, b0, b1, b2, b3;
unsigned a0, a1, a2, a3, b0, b1, b2, b3;
IDCT_COLS;
dest[0] = av_clip_pixel(dest[0] + ((a0 + b0) >> COL_SHIFT));
dest[0] = av_clip_pixel(dest[0] + ((int)(a0 + b0) >> COL_SHIFT));
dest += line_size;
dest[0] = av_clip_pixel(dest[0] + ((a1 + b1) >> COL_SHIFT));
dest[0] = av_clip_pixel(dest[0] + ((int)(a1 + b1) >> COL_SHIFT));
dest += line_size;
dest[0] = av_clip_pixel(dest[0] + ((a2 + b2) >> COL_SHIFT));
dest[0] = av_clip_pixel(dest[0] + ((int)(a2 + b2) >> COL_SHIFT));
dest += line_size;
dest[0] = av_clip_pixel(dest[0] + ((a3 + b3) >> COL_SHIFT));
dest[0] = av_clip_pixel(dest[0] + ((int)(a3 + b3) >> COL_SHIFT));
dest += line_size;
dest[0] = av_clip_pixel(dest[0] + ((a3 - b3) >> COL_SHIFT));
dest[0] = av_clip_pixel(dest[0] + ((int)(a3 - b3) >> COL_SHIFT));
dest += line_size;
dest[0] = av_clip_pixel(dest[0] + ((a2 - b2) >> COL_SHIFT));
dest[0] = av_clip_pixel(dest[0] + ((int)(a2 - b2) >> COL_SHIFT));
dest += line_size;
dest[0] = av_clip_pixel(dest[0] + ((a1 - b1) >> COL_SHIFT));
dest[0] = av_clip_pixel(dest[0] + ((int)(a1 - b1) >> COL_SHIFT));
dest += line_size;
dest[0] = av_clip_pixel(dest[0] + ((a0 - b0) >> COL_SHIFT));
dest[0] = av_clip_pixel(dest[0] + ((int)(a0 - b0) >> COL_SHIFT));
}
static inline void FUNC6(idctSparseCol)(idctin *col)

Write Preview
Loading…
Cancel
Save