diff mbox series

[FFmpeg-devel,1/2] avcodec/speexdec: Seed should be unsigned otherwise the operations done on it are undefined

Message ID 20211012130734.12774-1-michael@niedermayer.cc
State Accepted
Commit 85c169f6a62ad4e357ab139a4511854525938323
Headers show
Series [FFmpeg-devel,1/2] avcodec/speexdec: Seed should be unsigned otherwise the operations done on it are undefined | expand

Checks

Context Check Description
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished
andriy/make_ppc success Make finished
andriy/make_fate_ppc success Make fate finished

Commit Message

Michael Niedermayer Oct. 12, 2021, 1:07 p.m. UTC 
Fixes: signed integer overflow: 1664525000 + 1013904223 cannot be represented in type 'int'
Fixes: 39865/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEX_fuzzer-4979694508834816

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/speexdec.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

Comments

Paul B Mahol Oct. 12, 2021, 4:31 p.m. UTC | #1 
ok
Michael Niedermayer Oct. 13, 2021, 5:56 p.m. UTC | #2 
On Tue, Oct 12, 2021 at 06:31:14PM +0200, Paul B Mahol wrote:
> ok

will apply

thx

[...]
diff mbox series

Patch

diff --git a/libavcodec/speexdec.c b/libavcodec/speexdec.c
index fccceab74cb..4c50f54f27b 100644
--- a/libavcodec/speexdec.c
+++ b/libavcodec/speexdec.c
@@ -140,7 +140,7 @@  typedef void (*innovation_quant_func)(float *, float *,
 
 /** Innovation unquantization function */
 typedef void (*innovation_unquant_func)(float *, const void *, int,
-    GetBitContext *, int32_t *);
+    GetBitContext *, uint32_t *);
 
 typedef struct SpeexSubmode {
     int lbr_pitch; /**< Set to -1 for "normal" modes, otherwise encode pitch using
@@ -191,7 +191,7 @@  typedef struct DecoderState {
     /* This is used in packet loss concealment */
     int last_pitch; /**< Pitch of last correctly decoded frame */
     float last_pitch_gain; /**< Pitch gain of last correctly decoded frame */
-    int32_t seed; /** Seed used for random number generation */
+    uint32_t seed; /** Seed used for random number generation */
 
     int encode_submode;
     const SpeexSubmode *const *submodes; /**< Sub-mode data */
@@ -293,7 +293,7 @@  static void forced_pitch_unquant(float *exc, float *exc_out, int start, int end,
     gain_val[1] = pitch_coef;
 }
 
-static inline float speex_rand(float std, int32_t *seed)
+static inline float speex_rand(float std, uint32_t *seed)
 {
     const uint32_t jflone = 0x3f800000;
     const uint32_t jflmsk = 0x007fffff;
@@ -308,14 +308,14 @@  static inline float speex_rand(float std, int32_t *seed)
 }
 
 static void noise_codebook_unquant(float *exc, const void *par, int nsf,
-                                   GetBitContext *gb, int32_t *seed)
+                                   GetBitContext *gb, uint32_t *seed)
 {
     for (int i = 0; i < nsf; i++)
         exc[i] = speex_rand(1.f, seed);
 }
 
 static void split_cb_shape_sign_unquant(float *exc, const void *par, int nsf,
-                                        GetBitContext *gb, int32_t *seed)
+                                        GetBitContext *gb, uint32_t *seed)
 {
     int subvect_size, nb_subvect, have_sign, shape_bits;
     const SplitCodebookParams *params;