| Message ID | 20230326222642.2489-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 1942dbb8cab8417838793d9810a21673355f3a9b |
| Headers | show |
| Series | [FFmpeg-devel,1/4] avcodec/wavarc: Fix several integer overflows | expand |
| Context | Check | Description |
|---|---|---|
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
On Mon, Mar 27, 2023 at 12:26:39AM +0200, Michael Niedermayer wrote: > Fixes: signed integer overflow: -532410125 + -1759642300 cannot be represented in type 'int' > Fixes: 57045/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-637023665297817 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/wavarc.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) will apply patchset (with better commit message for the assert()) [...]
diff --git a/libavcodec/wavarc.c b/libavcodec/wavarc.c index 8d37af95716..896972cec82 100644 --- a/libavcodec/wavarc.c +++ b/libavcodec/wavarc.c @@ -349,7 +349,7 @@ static int decode_2slp(AVCodecContext *avctx, int sum = 15; for (int o = 0; o < order; o++) - sum += s->filter[ch][o] * samples[n + 70 - o - 1]; + sum += s->filter[ch][o] * (unsigned)samples[n + 70 - o - 1]; samples[n + 70] = get_srice(gb, k) + (sum >> 4); } @@ -452,7 +452,7 @@ fail: const int *src = s->samples[ch] + s->offset; for (int n = 0; n < frame->nb_samples; n++) - dst[n] = src[n] * (1 << s->shift) + 0x80U; + dst[n] = src[n] * (1U << s->shift) + 0x80U; } break; case AV_SAMPLE_FMT_S16P: @@ -461,7 +461,7 @@ fail: const int *src = s->samples[ch] + s->offset; for (int n = 0; n < frame->nb_samples; n++) - dst[n] = src[n] * (1 << s->shift); + dst[n] = src[n] * (1U << s->shift); } break; }
Fixes: signed integer overflow: -532410125 + -1759642300 cannot be represented in type 'int' Fixes: 57045/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-637023665297817 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/wavarc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)