[FFmpeg-devel] avcodec/lpc: signed integer overflow in compute_lpc_coefs() (aacdec_fixed)

Submitted by Michael Niedermayer on June 15, 2017, 12:17 a.m.

Details

Message ID 20170615001736.7258-1-michael@niedermayer.cc
State Accepted
Commit e95fcfe8fb28fdfdaecec465c60aad79bc340a3d
Headers show

Commit Message

Michael Niedermayer June 15, 2017, 12:17 a.m.
Fixes: runtime error: signed integer overflow: -1575818955 + -915383657 cannot be represented in type 'int'
Fixes: 2224/clusterfuzz-testcase-minimized-6208559949807616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/lpc.h | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

Comments

Michael Niedermayer June 20, 2017, 11:38 a.m.
On Thu, Jun 15, 2017 at 02:17:36AM +0200, Michael Niedermayer wrote:
> Fixes: runtime error: signed integer overflow: -1575818955 + -915383657 cannot be represented in type 'int'
> Fixes: 2224/clusterfuzz-testcase-minimized-6208559949807616
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/lpc.h | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)

applied

[...]

Patch hide | download patch | download mbox

diff --git a/libavcodec/lpc.h b/libavcodec/lpc.h
index 182adfa8ca..88ca247f87 100644
--- a/libavcodec/lpc.h
+++ b/libavcodec/lpc.h
@@ -117,11 +117,14 @@  void ff_lpc_end(LPCContext *s);
 
 #if USE_FIXED
 typedef int LPC_TYPE;
+typedef unsigned LPC_TYPE_U;
 #else
 #ifdef LPC_USE_DOUBLE
 typedef double LPC_TYPE;
+typedef double LPC_TYPE_U;
 #else
 typedef float LPC_TYPE;
+typedef float LPC_TYPE_U;
 #endif
 #endif // USE_FIXED
 
@@ -192,8 +195,8 @@  static inline int AAC_RENAME(compute_lpc_coefs)(const LPC_TYPE *autoc, int max_o
         for(j=0; j < (i+1)>>1; j++) {
             LPC_TYPE f = lpc_last[    j];
             LPC_TYPE b = lpc_last[i-1-j];
-            lpc[    j] = f + AAC_MUL26(r, b);
-            lpc[i-1-j] = b + AAC_MUL26(r, f);
+            lpc[    j] = f + (LPC_TYPE_U)AAC_MUL26(r, b);
+            lpc[i-1-j] = b + (LPC_TYPE_U)AAC_MUL26(r, f);
         }
 
         if (fail && err < 0)