Message ID | 20220328115251.24867-1-michael@niedermayer.cc |
---|---|
State | Accepted |
Commit | b085b400becb93ccc68d786ab738b1fc50408b89 |
Headers | show |
Series | [FFmpeg-devel,1/2] avcodec/apedec: fix a integer overflow in long_filter_high_3800() | expand |
On Mon, Mar 28, 2022 at 01:52:50PM +0200, Michael Niedermayer wrote: > Fixes: signed integer overflow: -2146549696 - 3923884 cannot be represented in type 'int' > Fixes: 45907/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5992380584558592 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/apedec.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) will apply patchset [...]
diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c index f7f8a88994..65e5d152e0 100644 --- a/libavcodec/apedec.c +++ b/libavcodec/apedec.c @@ -959,7 +959,7 @@ static void long_filter_high_3800(int32_t *buffer, int order, int shift, int len dotprod += delay[j] * (unsigned)coeffs[j]; coeffs[j] += ((delay[j] >> 31) | 1) * sign; } - buffer[i] -= dotprod >> shift; + buffer[i] -= (unsigned)(dotprod >> shift); for (j = 0; j < order - 1; j++) delay[j] = delay[j + 1]; delay[order - 1] = buffer[i];
Fixes: signed integer overflow: -2146549696 - 3923884 cannot be represented in type 'int' Fixes: 45907/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5992380584558592 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/apedec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)