Chiebot-Mirror
/
FFmpeg
mirror of https://github.com/FFmpeg/FFmpeg.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/h264_cavlc: Fix integer overflows with motion vector residual addition

Browse Source 
Fixes: signed integer overflow: 14 + 2147483647 cannot be represented in type 'int'
Fixes: 14794/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5677380695228416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
pull/317/head
Michael Niedermayer 6 years ago
parent c5f265bb24
commit b789ebf681
1 changed files with 8 additions and 8 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 16
      libavcodec/h264_cavlc.c

16
libavcodec/h264_cavlc.c
Unescape View File

@ -923,8 +923,8 @@ decode_intra_mb:
const int index= 4*i + block_width*j;
int16_t (* mv_cache)[2]= &sl->mv_cache[list][ scan8[index] ];
pred_motion(h, sl, index, block_width, list, sl->ref_cache[list][ scan8[index] ], &mx, &my);
mx += get_se_golomb(&sl->gb);
my += get_se_golomb(&sl->gb);
mx += (unsigned)get_se_golomb(&sl->gb);
my += (unsigned)get_se_golomb(&sl->gb);
ff_tlog(h->avctx, "final mv:%d %d\n", mx, my);
if(IS_SUB_8X8(sub_mb_type)){
@ -977,8 +977,8 @@ decode_intra_mb:
for (list = 0; list < sl->list_count; list++) {
if(IS_DIR(mb_type, 0, list)){
pred_motion(h, sl, 0, 4, list, sl->ref_cache[list][ scan8[0] ], &mx, &my);
mx += get_se_golomb(&sl->gb);
my += get_se_golomb(&sl->gb);
mx += (unsigned)get_se_golomb(&sl->gb);
my += (unsigned)get_se_golomb(&sl->gb);
ff_tlog(h->avctx, "final mv:%d %d\n", mx, my);
fill_rectangle(sl->mv_cache[list][ scan8[0] ], 4, 4, 8, pack16to32(mx,my), 4);
@ -1012,8 +1012,8 @@ decode_intra_mb:
unsigned int val;
if(IS_DIR(mb_type, i, list)){
pred_16x8_motion(h, sl, 8*i, list, sl->ref_cache[list][scan8[0] + 16*i], &mx, &my);
mx += get_se_golomb(&sl->gb);
my += get_se_golomb(&sl->gb);
mx += (unsigned)get_se_golomb(&sl->gb);
my += (unsigned)get_se_golomb(&sl->gb);
ff_tlog(h->avctx, "final mv:%d %d\n", mx, my);
val= pack16to32(mx,my);
@ -1050,8 +1050,8 @@ decode_intra_mb:
unsigned int val;
if(IS_DIR(mb_type, i, list)){
pred_8x16_motion(h, sl, i*4, list, sl->ref_cache[list][ scan8[0] + 2*i ], &mx, &my);
mx += get_se_golomb(&sl->gb);
my += get_se_golomb(&sl->gb);
mx += (unsigned)get_se_golomb(&sl->gb);
my += (unsigned)get_se_golomb(&sl->gb);
ff_tlog(h->avctx, "final mv:%d %d\n", mx, my);
val= pack16to32(mx,my);

Write Preview
Loading…
Cancel
Save