avcodec/apedec: Fix integer overflow in predictor_decode_stereo_3950()

Fixes: signed integer overflow: 1900031961 + 553590817 cannot be represented in type 'int'
Fixes: 63061/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5166188298371072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2def617787)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
pull/390/head
Michael Niedermayer 1 year ago
parent cebc2b3880
commit c9a9dbfebf
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
  1. 2
      libavcodec/apedec.c

@ -1284,7 +1284,7 @@ static void predictor_decode_stereo_3950(APEContext *ctx, int count)
*decoded1++ = a1;
if (num_passes > 1) {
int32_t left = a1 - (unsigned)(a0 / 2);
int32_t right = left + a0;
int32_t right = left + (unsigned)a0;
if (FFMAX(FFABS(left), FFABS(right)) > (1<<23)) {
ctx->interim_mode = !interim_mode;

Loading…
Cancel
Save