Chiebot-Mirror
/
FFmpeg
mirror of https://github.com/FFmpeg/FFmpeg.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

swscale/output: Fix integer overflows in yuv2rgba64_X_c_template

Browse Source 
Fixes: signed integer overflow: -1082982400 + -1068681048 cannot be represented in type 'int'
Fixes: 69995/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-6285740271534080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
release/7.1
Michael Niedermayer 4 months ago
parent d8d288479d
commit bcab9789ef
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 13 additions and 13 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 26
      libswscale/output.c

26
libswscale/output.c
Unescape View File

@ -1059,8 +1059,8 @@ yuv2rgba64_X_c_template(SwsContext *c, const int16_t *lumFilter,
for (i = 0; i < ((dstW + 1) >> 1); i++) { for (i = 0; i < ((dstW + 1) >> 1); i++) {
int j; int j;
int Y1 = -0x40000000; unsigned Y1 = -0x40000000;
int Y2 = -0x40000000; unsigned Y2 = -0x40000000;
int U = -(128 << 23); // 19 int U = -(128 << 23); // 19
int V = -(128 << 23); int V = -(128 << 23);
int R, G, B; int R, G, B;
@ -1088,9 +1088,9 @@ yuv2rgba64_X_c_template(SwsContext *c, const int16_t *lumFilter,
} }
// 8 bits: 12+15=27; 16 bits: 12+19=31 // 8 bits: 12+15=27; 16 bits: 12+19=31
Y1 >>= 14; // 10 Y1 = (int)Y1 >> 14; // 10
Y1 += 0x10000; Y1 += 0x10000;
Y2 >>= 14; Y2 = (int)Y2 >> 14;
Y2 += 0x10000; Y2 += 0x10000;
U >>= 14; U >>= 14;
V >>= 14; V >>= 14;
@ -1109,20 +1109,20 @@ yuv2rgba64_X_c_template(SwsContext *c, const int16_t *lumFilter,
B = U * c->yuv2rgb_u2b_coeff; B = U * c->yuv2rgb_u2b_coeff;
// 8 bits: 30 - 22 = 8 bits, 16 bits: 30 bits - 14 = 16 bits // 8 bits: 30 - 22 = 8 bits, 16 bits: 30 bits - 14 = 16 bits
output_pixel(&dest[0], av_clip_uintp2(((R_B + Y1) >> 14) + (1<<15), 16)); output_pixel(&dest[0], av_clip_uintp2(((int)(R_B + Y1) >> 14) + (1<<15), 16));
output_pixel(&dest[1], av_clip_uintp2((( G + Y1) >> 14) + (1<<15), 16)); output_pixel(&dest[1], av_clip_uintp2(((int)( G + Y1) >> 14) + (1<<15), 16));
output_pixel(&dest[2], av_clip_uintp2(((B_R + Y1) >> 14) + (1<<15), 16)); output_pixel(&dest[2], av_clip_uintp2(((int)(B_R + Y1) >> 14) + (1<<15), 16));
if (eightbytes) { if (eightbytes) {
output_pixel(&dest[3], av_clip_uintp2(A1 , 30) >> 14); output_pixel(&dest[3], av_clip_uintp2(A1 , 30) >> 14);
output_pixel(&dest[4], av_clip_uintp2(((R_B + Y2) >> 14) + (1<<15), 16)); output_pixel(&dest[4], av_clip_uintp2(((int)(R_B + Y2) >> 14) + (1<<15), 16));
output_pixel(&dest[5], av_clip_uintp2((( G + Y2) >> 14) + (1<<15), 16)); output_pixel(&dest[5], av_clip_uintp2(((int)( G + Y2) >> 14) + (1<<15), 16));
output_pixel(&dest[6], av_clip_uintp2(((B_R + Y2) >> 14) + (1<<15), 16)); output_pixel(&dest[6], av_clip_uintp2(((int)(B_R + Y2) >> 14) + (1<<15), 16));
output_pixel(&dest[7], av_clip_uintp2(A2 , 30) >> 14); output_pixel(&dest[7], av_clip_uintp2(A2 , 30) >> 14);
dest += 8; dest += 8;
} else { } else {
output_pixel(&dest[3], av_clip_uintp2(((R_B + Y2) >> 14) + (1<<15), 16)); output_pixel(&dest[3], av_clip_uintp2(((int)(R_B + Y2) >> 14) + (1<<15), 16));
output_pixel(&dest[4], av_clip_uintp2((( G + Y2) >> 14) + (1<<15), 16)); output_pixel(&dest[4], av_clip_uintp2(((int)( G + Y2) >> 14) + (1<<15), 16));
output_pixel(&dest[5], av_clip_uintp2(((B_R + Y2) >> 14) + (1<<15), 16)); output_pixel(&dest[5], av_clip_uintp2(((int)(B_R + Y2) >> 14) + (1<<15), 16));
dest += 6; dest += 6;
} }
} }

Write Preview
Loading…
Cancel
Save