Chiebot-Mirror
/
FFmpeg
mirror of https://github.com/FFmpeg/FFmpeg.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/alsdec: Fixes invalid shifts in read_var_block_data() and INTERLEAVE_OUTPUT()

Browse Source 
Fixes: left shift of negative value -6
Fixes: 15275/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5742361767837696
Fixes: signed integer overflow: 41582592 * 256 cannot be represented in type 'int'
Fixes: 15296/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5739558227935232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
pull/316/head
Michael Niedermayer 5 years ago
parent eb33be188d
commit e131568752
1 changed files with 6 additions and 6 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 12
      libavcodec/alsdec.c

12
libavcodec/alsdec.c
Unescape View File

@ -767,8 +767,8 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
if (*bd->use_ltp) {
int r, c;
bd->ltp_gain[0] = decode_rice(gb, 1) << 3;
bd->ltp_gain[1] = decode_rice(gb, 2) << 3;
bd->ltp_gain[0] = decode_rice(gb, 1) * 8;
bd->ltp_gain[1] = decode_rice(gb, 2) * 8;
r = get_unary(gb, 0, 4);
c = get_bits(gb, 2);
@ -779,8 +779,8 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd)
bd->ltp_gain[2] = ltp_gain_values[r][c];
bd->ltp_gain[3] = decode_rice(gb, 2) << 3;
bd->ltp_gain[4] = decode_rice(gb, 1) << 3;
bd->ltp_gain[3] = decode_rice(gb, 2) * 8;
bd->ltp_gain[4] = decode_rice(gb, 1) * 8;
*bd->ltp_lag = get_bits(gb, ctx->ltp_lag_length);
*bd->ltp_lag += FFMAX(4, opt_order + 1);
@ -1799,11 +1799,11 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame_ptr,
if (!ctx->cs_switch) { \
for (sample = 0; sample < ctx->cur_frame_length; sample++) \
for (c = 0; c < avctx->channels; c++) \
*dest++ = ctx->raw_samples[c][sample] << shift; \
*dest++ = ctx->raw_samples[c][sample] * (1U << shift); \
} else { \
for (sample = 0; sample < ctx->cur_frame_length; sample++) \
for (c = 0; c < avctx->channels; c++) \
*dest++ = ctx->raw_samples[sconf->chan_pos[c]][sample] << shift; \
*dest++ = ctx->raw_samples[sconf->chan_pos[c]][sample] * (1U << shift); \
} \
}

Write Preview
Loading…
Cancel
Save