diff mbox

[FFmpeg-devel,3/3] avcodec/simple_idct_template: Fix integer overflow in idctSparseColAdd()

Message ID 20190625233234.15021-3-michael@niedermayer.cc
State Accepted
Commit 85cbd042ff801b4c4e13fca637d2dd25b7a312ff
Headers show

Commit Message

Michael Niedermayer June 25, 2019, 11:32 p.m. UTC 
Fixes: signed integer overflow: 1106434976 + 1041773512 cannot be represented in type 'int'
Fixes: 15421/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV2_fuzzer-5669209314426880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/simple_idct_template.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)
diff mbox

Patch

diff --git a/libavcodec/simple_idct_template.c b/libavcodec/simple_idct_template.c
index 90d1c21355..d8fcfd7c53 100644
--- a/libavcodec/simple_idct_template.c
+++ b/libavcodec/simple_idct_template.c
@@ -288,25 +288,25 @@  static inline void FUNC6(idctSparseColPut)(pixel *dest, ptrdiff_t line_size,
 static inline void FUNC6(idctSparseColAdd)(pixel *dest, ptrdiff_t line_size,
                                           idctin *col)
 {
-    int a0, a1, a2, a3, b0, b1, b2, b3;
+    unsigned a0, a1, a2, a3, b0, b1, b2, b3;
 
     IDCT_COLS;
 
-    dest[0] = av_clip_pixel(dest[0] + ((a0 + b0) >> COL_SHIFT));
+    dest[0] = av_clip_pixel(dest[0] + ((int)(a0 + b0) >> COL_SHIFT));
     dest += line_size;
-    dest[0] = av_clip_pixel(dest[0] + ((a1 + b1) >> COL_SHIFT));
+    dest[0] = av_clip_pixel(dest[0] + ((int)(a1 + b1) >> COL_SHIFT));
     dest += line_size;
-    dest[0] = av_clip_pixel(dest[0] + ((a2 + b2) >> COL_SHIFT));
+    dest[0] = av_clip_pixel(dest[0] + ((int)(a2 + b2) >> COL_SHIFT));
     dest += line_size;
-    dest[0] = av_clip_pixel(dest[0] + ((a3 + b3) >> COL_SHIFT));
+    dest[0] = av_clip_pixel(dest[0] + ((int)(a3 + b3) >> COL_SHIFT));
     dest += line_size;
-    dest[0] = av_clip_pixel(dest[0] + ((a3 - b3) >> COL_SHIFT));
+    dest[0] = av_clip_pixel(dest[0] + ((int)(a3 - b3) >> COL_SHIFT));
     dest += line_size;
-    dest[0] = av_clip_pixel(dest[0] + ((a2 - b2) >> COL_SHIFT));
+    dest[0] = av_clip_pixel(dest[0] + ((int)(a2 - b2) >> COL_SHIFT));
     dest += line_size;
-    dest[0] = av_clip_pixel(dest[0] + ((a1 - b1) >> COL_SHIFT));
+    dest[0] = av_clip_pixel(dest[0] + ((int)(a1 - b1) >> COL_SHIFT));
     dest += line_size;
-    dest[0] = av_clip_pixel(dest[0] + ((a0 - b0) >> COL_SHIFT));
+    dest[0] = av_clip_pixel(dest[0] + ((int)(a0 - b0) >> COL_SHIFT));
 }
 
 static inline void FUNC6(idctSparseCol)(idctin *col)