diff mbox

[FFmpeg-devel,4/6] avcodec/h264_mvpred: Fix runtime error: left shift of negative value -1

Message ID 20170308222843.9289-4-michael@niedermayer.cc
State Accepted
Commit 222c9f031de3315af62be6d7a99c71105e516088
Headers show

Commit Message

Michael Niedermayer March 8, 2017, 10:28 p.m. UTC 
Fixes: 734/clusterfuzz-testcase-4821293192970240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/h264_mvpred.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Michael Niedermayer March 9, 2017, 10:25 p.m. UTC | #1 
On Wed, Mar 08, 2017 at 11:28:41PM +0100, Michael Niedermayer wrote:
> Fixes: 734/clusterfuzz-testcase-4821293192970240
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/h264_mvpred.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

applied

[...]
diff mbox

Patch

diff --git a/libavcodec/h264_mvpred.h b/libavcodec/h264_mvpred.h
index 339cf623d5..bf395e3fe2 100644
--- a/libavcodec/h264_mvpred.h
+++ b/libavcodec/h264_mvpred.h
@@ -68,7 +68,7 @@  static av_always_inline int fetch_diagonal_mv(const H264Context *h, H264SliceCon
             }
             if (MB_FIELD(sl) && !IS_INTERLACED(sl->left_type[0])) {
                 // left shift will turn LIST_NOT_USED into PART_NOT_AVAILABLE, but that's OK.
-                SET_DIAG_MV(/ 2, << 1, sl->left_mb_xy[i >= 36], ((i >> 2)) & 3);
+                SET_DIAG_MV(/ 2, *2, sl->left_mb_xy[i >= 36], ((i >> 2)) & 3);
             }
         }
 #undef SET_DIAG_MV