[FFmpeg-cvslog] avcodec/mpeg4videodec: Fix integer overflow in num_sprite_warping_points=2 case
Michael Niedermayer
git at videolan.org
Thu Jun 15 01:18:28 EEST 2017
ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Wed Jun 14 23:49:23 2017 +0200| [0a87be404ab7e3f47e67e79160dcc9623e36835b] | committer: Michael Niedermayer
avcodec/mpeg4videodec: Fix integer overflow in num_sprite_warping_points=2 case
Fixes: runtime error: signed integer overflow: 131072 + 2147352576 cannot be represented in type 'int'
Fixes: 2192/clusterfuzz-testcase-minimized-5370387988742144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0a87be404ab7e3f47e67e79160dcc9623e36835b
---
libavcodec/mpeg4videodec.c | 40 ++++++++++++++++++++--------------------
1 file changed, 20 insertions(+), 20 deletions(-)
diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
index 304ab47000..3edf266580 100644
--- a/libavcodec/mpeg4videodec.c
+++ b/libavcodec/mpeg4videodec.c
@@ -284,26 +284,26 @@ static int mpeg4_decode_sprite_trajectory(Mpeg4DecContext *ctx, GetBitContext *g
ctx->sprite_shift[1] = 0;
break;
case 2:
- sprite_offset[0][0] = (sprite_ref[0][0] * (1 << alpha + rho)) +
- (-r * sprite_ref[0][0] + virtual_ref[0][0]) *
- (-vop_ref[0][0]) +
- (r * sprite_ref[0][1] - virtual_ref[0][1]) *
- (-vop_ref[0][1]) + (1 << (alpha + rho - 1));
- sprite_offset[0][1] = (sprite_ref[0][1] * (1 << alpha + rho)) +
- (-r * sprite_ref[0][1] + virtual_ref[0][1]) *
- (-vop_ref[0][0]) +
- (-r * sprite_ref[0][0] + virtual_ref[0][0]) *
- (-vop_ref[0][1]) + (1 << (alpha + rho - 1));
- sprite_offset[1][0] = ((-r * sprite_ref[0][0] + virtual_ref[0][0]) *
- (-2 * vop_ref[0][0] + 1) +
- (r * sprite_ref[0][1] - virtual_ref[0][1]) *
- (-2 * vop_ref[0][1] + 1) + 2 * w2 * r *
- sprite_ref[0][0] - 16 * w2 + (1 << (alpha + rho + 1)));
- sprite_offset[1][1] = ((-r * sprite_ref[0][1] + virtual_ref[0][1]) *
- (-2 * vop_ref[0][0] + 1) +
- (-r * sprite_ref[0][0] + virtual_ref[0][0]) *
- (-2 * vop_ref[0][1] + 1) + 2 * w2 * r *
- sprite_ref[0][1] - 16 * w2 + (1 << (alpha + rho + 1)));
+ sprite_offset[0][0] = ((int64_t) sprite_ref[0][0] * (1 << alpha + rho)) +
+ ((int64_t) -r * sprite_ref[0][0] + virtual_ref[0][0]) *
+ ((int64_t) -vop_ref[0][0]) +
+ ((int64_t) r * sprite_ref[0][1] - virtual_ref[0][1]) *
+ ((int64_t) -vop_ref[0][1]) + (1 << (alpha + rho - 1));
+ sprite_offset[0][1] = ((int64_t) sprite_ref[0][1] * (1 << alpha + rho)) +
+ ((int64_t) -r * sprite_ref[0][1] + virtual_ref[0][1]) *
+ ((int64_t) -vop_ref[0][0]) +
+ ((int64_t) -r * sprite_ref[0][0] + virtual_ref[0][0]) *
+ ((int64_t) -vop_ref[0][1]) + (1 << (alpha + rho - 1));
+ sprite_offset[1][0] = (((int64_t)-r * sprite_ref[0][0] + virtual_ref[0][0]) *
+ ((int64_t)-2 * vop_ref[0][0] + 1) +
+ ((int64_t) r * sprite_ref[0][1] - virtual_ref[0][1]) *
+ ((int64_t)-2 * vop_ref[0][1] + 1) + 2 * w2 * r *
+ (int64_t) sprite_ref[0][0] - 16 * w2 + (1 << (alpha + rho + 1)));
+ sprite_offset[1][1] = (((int64_t)-r * sprite_ref[0][1] + virtual_ref[0][1]) *
+ ((int64_t)-2 * vop_ref[0][0] + 1) +
+ ((int64_t)-r * sprite_ref[0][0] + virtual_ref[0][0]) *
+ ((int64_t)-2 * vop_ref[0][1] + 1) + 2 * w2 * r *
+ (int64_t) sprite_ref[0][1] - 16 * w2 + (1 << (alpha + rho + 1)));
s->sprite_delta[0][0] = (-r * sprite_ref[0][0] + virtual_ref[0][0]);
s->sprite_delta[0][1] = (+r * sprite_ref[0][1] - virtual_ref[0][1]);
s->sprite_delta[1][0] = (-r * sprite_ref[0][1] + virtual_ref[0][1]);
More information about the ffmpeg-cvslog
mailing list