[FFmpeg-cvslog] avcodec/wavarc: Fix several integer overflows

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Sun Mar 26 19:49:21 2023 +0200| [1942dbb8cab8417838793d9810a21673355f3a9b] | committer: Michael Niedermayer

avcodec/wavarc: Fix several integer overflows

Fixes: signed integer overflow: -532410125 + -1759642300 cannot be represented in type 'int'
Fixes: 57045/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-637023665297817

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1942dbb8cab8417838793d9810a21673355f3a9b
---

 libavcodec/wavarc.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavcodec/wavarc.c b/libavcodec/wavarc.c
index 8d37af9571..896972cec8 100644
--- a/libavcodec/wavarc.c
+++ b/libavcodec/wavarc.c
@@ -349,7 +349,7 @@ static int decode_2slp(AVCodecContext *avctx,
                 int sum = 15;
 
                 for (int o = 0; o < order; o++)
-                    sum += s->filter[ch][o] * samples[n + 70 - o - 1];
+                    sum += s->filter[ch][o] * (unsigned)samples[n + 70 - o - 1];
 
                 samples[n + 70] = get_srice(gb, k) + (sum >> 4);
             }
@@ -452,7 +452,7 @@ fail:
             const int *src = s->samples[ch] + s->offset;
 
             for (int n = 0; n < frame->nb_samples; n++)
-                dst[n] = src[n] * (1 << s->shift) + 0x80U;
+                dst[n] = src[n] * (1U << s->shift) + 0x80U;
         }
         break;
     case AV_SAMPLE_FMT_S16P:
@@ -461,7 +461,7 @@ fail:
             const int *src = s->samples[ch] + s->offset;
 
             for (int n = 0; n < frame->nb_samples; n++)
-                dst[n] = src[n] * (1 << s->shift);
+                dst[n] = src[n] * (1U << s->shift);
         }
         break;
     }