| Message ID | 20210306195140.7082-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | be08b84f8bb7acc0c45800c7f488399327a22961 |
| Headers | show |
| Series | [FFmpeg-devel,1/2] avcodec/ffwavesynth: Avoid signed integer overflow in phi_at() | expand |
| Context | Check | Description |
|---|---|---|
| andriy/x86_make | success | Make finished |
| andriy/x86_make_fate | success | Make fate finished |
| andriy/PPC64_make | success | Make finished |
| andriy/PPC64_make_fate | success | Make fate finished |
Michael Niedermayer (12021-03-06): > Fixes: signed integer overflow: 2314885530818453536 - -9070214327174160352 cannot be represented in type 'long' > Fixes: 31000/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-6558389742206976 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/ffwavesynth.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) No objection. Regards,
On Tue, Mar 23, 2021 at 02:09:22PM +0100, Nicolas George wrote: > Michael Niedermayer (12021-03-06): > > Fixes: signed integer overflow: 2314885530818453536 - -9070214327174160352 cannot be represented in type 'long' > > Fixes: 31000/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-6558389742206976 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/ffwavesynth.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > No objection. will apply thx [...]
diff --git a/libavcodec/ffwavesynth.c b/libavcodec/ffwavesynth.c index 7e7e1f6954..3f982d07cf 100644 --- a/libavcodec/ffwavesynth.c +++ b/libavcodec/ffwavesynth.c @@ -188,7 +188,7 @@ static uint64_t frac64(uint64_t a, uint64_t b) static uint64_t phi_at(struct ws_interval *in, int64_t ts) { - uint64_t dt = ts - in->ts_start; + uint64_t dt = ts - (uint64_t)in->ts_start; uint64_t dt2 = dt & 1 ? /* dt * (dt - 1) / 2 without overflow */ dt * ((dt - 1) >> 1) : (dt >> 1) * (dt - 1); return in->phi0 + dt * in->dphi0 + dt2 * in->ddphi;
Fixes: signed integer overflow: 2314885530818453536 - -9070214327174160352 cannot be represented in type 'long' Fixes: 31000/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-6558389742206976 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/ffwavesynth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)