| Message ID | 20180813002423.10292-3-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 9b604e96a51a1fca92bbabfe4f7ac53f0470ee41 |
| Headers | show |
On Mon, Aug 13, 2018 at 02:24:20AM +0200, Michael Niedermayer wrote: > Fixes: runtime error: left shift of 1 by 31 places cannot be represented in type 'int' > Fixes: 9480/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-6647324284551168 -rss_limit_mb=2000 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/shorten.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) will apply [...]
diff --git a/libavcodec/shorten.c b/libavcodec/shorten.c index 054494f8ce..1ffb7d8d79 100644 --- a/libavcodec/shorten.c +++ b/libavcodec/shorten.c @@ -715,7 +715,7 @@ static int shorten_decode_frame(AVCodecContext *avctx, void *data, if (s->version < 2) s->offset[channel][s->nmean - 1] = sum / s->blocksize; else - s->offset[channel][s->nmean - 1] = s->bitshift == 32 ? 0 : (sum / s->blocksize) * (1 << s->bitshift); + s->offset[channel][s->nmean - 1] = s->bitshift == 32 ? 0 : (sum / s->blocksize) * (1LL << s->bitshift); } /* copy wrap samples for use with next block */
Fixes: runtime error: left shift of 1 by 31 places cannot be represented in type 'int' Fixes: 9480/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-6647324284551168 -rss_limit_mb=2000 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/shorten.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)