avcodec/h264idct_template: Fix integer overflow in ff_h264_idct_add()

Fixes: runtime error: signed integer overflow: 26215360 + 2121330944 cannot be represented in type 'int'
Fixes: 2809/clusterfuzz-testcase-minimized-4785181833560064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
pull/265/head
Michael Niedermayer 7 years ago
parent 50aeb6e4ed
commit d1bfa80ec4
  1. 8
      libavcodec/h264idct_template.c

@ -40,10 +40,10 @@ void FUNCC(ff_h264_idct_add)(uint8_t *_dst, int16_t *_block, int stride)
block[0] += 1 << 5;
for(i=0; i<4; i++){
const SUINT z0= block[i + 4*0] + block[i + 4*2];
const SUINT z1= block[i + 4*0] - block[i + 4*2];
const SUINT z2= (block[i + 4*1]>>1) - block[i + 4*3];
const SUINT z3= block[i + 4*1] + (block[i + 4*3]>>1);
const SUINT z0= block[i + 4*0] + (unsigned)block[i + 4*2];
const SUINT z1= block[i + 4*0] - (unsigned)block[i + 4*2];
const SUINT z2= (block[i + 4*1]>>1) - (unsigned)block[i + 4*3];
const SUINT z3= block[i + 4*1] + (unsigned)(block[i + 4*3]>>1);
block[i + 4*0]= z0 + z3;
block[i + 4*1]= z1 + z2;

Loading…
Cancel
Save