[FFmpeg-cvslog] avcodec/simple_idct_template: Fix integer overflow in idctSparseCol()

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Wed Jun 26 00:03:01 2019 +0200| [b5f2cfd2ad2b269d3de79083dbb9162a632b69bb] | committer: Michael Niedermayer

avcodec/simple_idct_template: Fix integer overflow in idctSparseCol()

Fixes: signed integer overflow: -1027919784 + -1120041624 cannot be represented in type 'int'
Fixes: 15406/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5700646528876544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b5f2cfd2ad2b269d3de79083dbb9162a632b69bb
---

 libavcodec/simple_idct_template.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/libavcodec/simple_idct_template.c b/libavcodec/simple_idct_template.c
index 35c31321c6..90d1c21355 100644
--- a/libavcodec/simple_idct_template.c
+++ b/libavcodec/simple_idct_template.c
@@ -312,18 +312,18 @@ static inline void FUNC6(idctSparseColAdd)(pixel *dest, ptrdiff_t line_size,
 static inline void FUNC6(idctSparseCol)(idctin *col)
 #endif
 {
-    int a0, a1, a2, a3, b0, b1, b2, b3;
+    unsigned a0, a1, a2, a3, b0, b1, b2, b3;
 
     IDCT_COLS;
 
-    col[0 ] = ((a0 + b0) >> COL_SHIFT);
-    col[8 ] = ((a1 + b1) >> COL_SHIFT);
-    col[16] = ((a2 + b2) >> COL_SHIFT);
-    col[24] = ((a3 + b3) >> COL_SHIFT);
-    col[32] = ((a3 - b3) >> COL_SHIFT);
-    col[40] = ((a2 - b2) >> COL_SHIFT);
-    col[48] = ((a1 - b1) >> COL_SHIFT);
-    col[56] = ((a0 - b0) >> COL_SHIFT);
+    col[0 ] = ((int)(a0 + b0) >> COL_SHIFT);
+    col[8 ] = ((int)(a1 + b1) >> COL_SHIFT);
+    col[16] = ((int)(a2 + b2) >> COL_SHIFT);
+    col[24] = ((int)(a3 + b3) >> COL_SHIFT);
+    col[32] = ((int)(a3 - b3) >> COL_SHIFT);
+    col[40] = ((int)(a2 - b2) >> COL_SHIFT);
+    col[48] = ((int)(a1 - b1) >> COL_SHIFT);
+    col[56] = ((int)(a0 - b0) >> COL_SHIFT);
 }
 
 #ifndef EXTRA_SHIFT