[FFmpeg-devel] [PATCH 2/2] avcodec/adpcm: Clip predictor for APC

[Limin Wang]

On Thu, Nov 21, 2019 at 11:26:12PM +0100, Michael Niedermayer wrote:
> Fixes: signed integer overflow: -2147483648 - 13 cannot be represented in type 'int'
> Fixes: 18893/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_APC_fuzzer-5630760442920960
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/adpcm.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c
> index edf7052636..d3919288b1 100644
> --- a/libavcodec/adpcm.c
> +++ b/libavcodec/adpcm.c
> @@ -140,8 +140,8 @@ static av_cold int adpcm_decode_init(AVCodecContext * avctx)
>          break;
>      case AV_CODEC_ID_ADPCM_IMA_APC:
>          if (avctx->extradata && avctx->extradata_size >= 8) {
> -            c->status[0].predictor = AV_RL32(avctx->extradata);
> -            c->status[1].predictor = AV_RL32(avctx->extradata + 4);
> +            c->status[0].predictor = av_clip_intp2(AV_RL32(avctx->extradata    ), 18);
> +            c->status[1].predictor = av_clip_intp2(AV_RL32(avctx->extradata + 4), 18);

18 is 16? I understand c->status[i].predictor is 16bit.

>          }
>          break;
>      case AV_CODEC_ID_ADPCM_IMA_WS:
> -- 
> 2.23.0
> 
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".