Chiebot-Mirror
/
FFmpeg
mirror of https://github.com/FFmpeg/FFmpeg.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/xvididct: Fix integer overflow in idct_row()

Browse Source 
Fixes: signed integer overflow: -1403461578 + -843974775 cannot be represented in type 'int'
Fixes: 60868/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-4599793035378688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ce322a51e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
release/6.0
Michael Niedermayer 1 year ago
parent 1e26c4923a
commit ab1981b445
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 12 additions and 12 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 24
      libavcodec/xvididct.c

24
libavcodec/xvididct.c
Unescape View File

@ -69,24 +69,24 @@ static int idct_row(short *in, const int *const tab, int rnd)
if (!(right | in[4])) {
const int k = c4 * in[0] + rnd;
if (left) {
const int a0 = k + c2 * in[2];
const int a1 = k + c6 * in[2];
const int a2 = k - c6 * in[2];
const int a3 = k - c2 * in[2];
const unsigned a0 = k + c2 * in[2];
const unsigned a1 = k + c6 * in[2];
const unsigned a2 = k - c6 * in[2];
const unsigned a3 = k - c2 * in[2];
const int b0 = c1 * in[1] + c3 * in[3];
const int b1 = c3 * in[1] - c7 * in[3];
const int b2 = c5 * in[1] - c1 * in[3];
const int b3 = c7 * in[1] - c5 * in[3];
in[0] = (a0 + b0) >> ROW_SHIFT;
in[1] = (a1 + b1) >> ROW_SHIFT;
in[2] = (a2 + b2) >> ROW_SHIFT;
in[3] = (a3 + b3) >> ROW_SHIFT;
in[4] = (a3 - b3) >> ROW_SHIFT;
in[5] = (a2 - b2) >> ROW_SHIFT;
in[6] = (a1 - b1) >> ROW_SHIFT;
in[7] = (a0 - b0) >> ROW_SHIFT;
in[0] = (int)(a0 + b0) >> ROW_SHIFT;
in[1] = (int)(a1 + b1) >> ROW_SHIFT;
in[2] = (int)(a2 + b2) >> ROW_SHIFT;
in[3] = (int)(a3 + b3) >> ROW_SHIFT;
in[4] = (int)(a3 - b3) >> ROW_SHIFT;
in[5] = (int)(a2 - b2) >> ROW_SHIFT;
in[6] = (int)(a1 - b1) >> ROW_SHIFT;
in[7] = (int)(a0 - b0) >> ROW_SHIFT;
} else {
const int a0 = k >> ROW_SHIFT;
if (a0) {

Write Preview
Loading…
Cancel
Save