| Message ID | 20200618122026.24534-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 3b8d5bcc3189c6c46279889f1176c0caba4466e4 |
| Headers | show |
| Series | [FFmpeg-devel,1/4] avcodec/mv30: Fix integer overflows in idct2_1d() | expand |
| Context | Check | Description |
|---|---|---|
| andriy/default | pending | |
| andriy/make | success | Make finished |
| andriy/make_fate | success | Make fate finished |
On Thu, Jun 18, 2020 at 02:20:23PM +0200, Michael Niedermayer wrote: > Fixes: signed integer overflow: 6500736 * 473 cannot be represented in type 'int' > Fixes: 23259/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MV30_fuzzer-5179394271477760 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/mv30.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) will apply [...]
diff --git a/libavcodec/mv30.c b/libavcodec/mv30.c index 76b9170eaf..c83ba7ffbd 100644 --- a/libavcodec/mv30.c +++ b/libavcodec/mv30.c @@ -200,10 +200,10 @@ static inline void idct2_1d(int *blk, int step) { const int t0 = blk[0 * step]; const int t1 = blk[1 * step]; - const int t2 = t1 * 473 >> 8; + const int t2 = (int)(t1 * 473U) >> 8; const int t3 = t2 - t1; - const int t4 = (t1 * 362 >> 8) - t3; - const int t5 = ((t1 * 277 >> 8) - t2) + t4; + const int t4 = ((int)(t1 * 362U) >> 8) - t3; + const int t5 = (((int)(t1 * 277U) >> 8) - t2) + t4; blk[0 * step] = t1 + t0; blk[1 * step] = t0 + t3;
Fixes: signed integer overflow: 6500736 * 473 cannot be represented in type 'int' Fixes: 23259/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MV30_fuzzer-5179394271477760 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/mv30.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)