| Message ID | 20190620224721.8480-6-michael@niedermayer.cc |
|---|---|
| State | New |
| Headers | show |
On Fri, Jun 21, 2019 at 12:47:20AM +0200, Michael Niedermayer wrote: > Fixes: signed integer overflow: 41582592 * 256 cannot be represented in type 'int' > Fixes: 15296/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5739558227935232 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/alsdec.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) will combine this with the other overflow fix in here and apply [...]
diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c index 57d558c1c6..8d68fa24e6 100644 --- a/libavcodec/alsdec.c +++ b/libavcodec/alsdec.c @@ -1805,11 +1805,11 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame_ptr, if (!ctx->cs_switch) { \ for (sample = 0; sample < ctx->cur_frame_length; sample++) \ for (c = 0; c < avctx->channels; c++) \ - *dest++ = ctx->raw_samples[c][sample] * (1 << shift); \ + *dest++ = ctx->raw_samples[c][sample] * (1U << shift); \ } else { \ for (sample = 0; sample < ctx->cur_frame_length; sample++) \ for (c = 0; c < avctx->channels; c++) \ - *dest++ = ctx->raw_samples[sconf->chan_pos[c]][sample] * (1 << shift); \ + *dest++ = ctx->raw_samples[sconf->chan_pos[c]][sample] * (1U << shift); \ } \ }
Fixes: signed integer overflow: 41582592 * 256 cannot be represented in type 'int' Fixes: 15296/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5739558227935232 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/alsdec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)