diff mbox

[FFmpeg-devel,2/3] avcodec/h264idct_template: fix multiple runtime error: signed integer overflow

Message ID 20170315031251.22570-2-michael@niedermayer.cc
State Accepted
Commit 2898bc522da6adebda5cbbd9036defe22e3b9bcf
Headers show

Commit Message

Michael Niedermayer March 15, 2017, 3:12 a.m. UTC 
Fixes: 857/clusterfuzz-testcase-5319093760557056

Benchmark changes from 335->333 (so if its not a random fluctuation then it would be faster)

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/h264idct_template.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

Comments

Michael Niedermayer March 16, 2017, 2:42 p.m. UTC | #1 
On Wed, Mar 15, 2017 at 04:12:50AM +0100, Michael Niedermayer wrote:
> Fixes: 857/clusterfuzz-testcase-5319093760557056
> 
> Benchmark changes from 335->333 (so if its not a random fluctuation then it would be faster)
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/h264idct_template.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)

applied

[...]
diff mbox

Patch

diff --git a/libavcodec/h264idct_template.c b/libavcodec/h264idct_template.c
index c62716090c..229a9ac36b 100644
--- a/libavcodec/h264idct_template.c
+++ b/libavcodec/h264idct_template.c
@@ -304,7 +304,7 @@  void FUNCC(ff_h264_chroma422_dc_dequant_idct)(int16_t *_block, int qmul){
 void FUNCC(ff_h264_chroma_dc_dequant_idct)(int16_t *_block, int qmul){
     const int stride= 16*2;
     const int xStride= 16;
-    int a,b,c,d,e;
+    SUINT a,b,c,d,e;
     dctcoef *block = (dctcoef*)_block;
 
     a= block[stride*0 + xStride*0];
@@ -317,8 +317,8 @@  void FUNCC(ff_h264_chroma_dc_dequant_idct)(int16_t *_block, int qmul){
     b= c-d;
     c= c+d;
 
-    block[stride*0 + xStride*0]= ((a+c)*qmul) >> 7;
-    block[stride*0 + xStride*1]= ((e+b)*qmul) >> 7;
-    block[stride*1 + xStride*0]= ((a-c)*qmul) >> 7;
-    block[stride*1 + xStride*1]= ((e-b)*qmul) >> 7;
+    block[stride*0 + xStride*0]= (int)((a+c)*qmul) >> 7;
+    block[stride*0 + xStride*1]= (int)((e+b)*qmul) >> 7;
+    block[stride*1 + xStride*0]= (int)((a-c)*qmul) >> 7;
+    block[stride*1 + xStride*1]= (int)((e-b)*qmul) >> 7;
 }