[FFmpeg-cvslog] avcodec/takdec: Fix integer overflow in decorrelate()
Michael Niedermayer
git at videolan.org
Thu Sep 12 01:26:50 EEST 2019
ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Sun Aug 25 17:49:15 2019 +0200| [f1192736494a5b16717de66da4a3d3c6af0e9a7a] | committer: Michael Niedermayer
avcodec/takdec: Fix integer overflow in decorrelate()
Fixes: signed integer overflow: -2424832 - 2145653689 cannot be represented in type 'int'
Fixes: 16138/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5643451346976768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f1192736494a5b16717de66da4a3d3c6af0e9a7a
---
libavcodec/takdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/takdec.c b/libavcodec/takdec.c
index 0439a3ac9b..4fb5825532 100644
--- a/libavcodec/takdec.c
+++ b/libavcodec/takdec.c
@@ -653,7 +653,7 @@ static int decorrelate(TAKDecContext *s, int c1, int c2, int length)
s->residues[i ] * s->filter[0];
}
- v = av_clip_intp2(v >> 10, 13) * (1 << dshift) - *p1;
+ v = av_clip_intp2(v >> 10, 13) * (1U << dshift) - *p1;
*p1++ = v;
}
More information about the ffmpeg-cvslog
mailing list