diff mbox series

[FFmpeg-devel,3/4] avutil/tx_template: Fix some signed integer overflows in DECL_FFT5()

Message ID 20230915131147.5945-3-michael@niedermayer.cc
State Accepted
Commit c42a89309ae5e5bf856a6a28f9294562a8b89c48
Headers show
Series [FFmpeg-devel,1/4] avcodec/evc_ps: Check cpb_cnt_minus1 and propagate error | expand

Checks

Context Check Description
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Michael Niedermayer Sept. 15, 2023, 1:11 p.m. UTC 
Fixes: signed integer overflow: -1364715454 + -1468954671 cannot be represented in type 'int'
Fixes: 62093/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5538774254485504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavutil/tx_template.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

Comments

Michael Niedermayer Oct. 3, 2023, 2:30 p.m. UTC | #1 
On Fri, Sep 15, 2023 at 03:11:46PM +0200, Michael Niedermayer wrote:
> Fixes: signed integer overflow: -1364715454 + -1468954671 cannot be represented in type 'int'
> Fixes: 62093/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5538774254485504
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavutil/tx_template.c | 20 ++++++++++----------
>  1 file changed, 10 insertions(+), 10 deletions(-)

will apply

[...]
diff mbox series

Patch

diff --git a/libavutil/tx_template.c b/libavutil/tx_template.c
index 6e3b3dad338..8dc3d2519c1 100644
--- a/libavutil/tx_template.c
+++ b/libavutil/tx_template.c
@@ -222,8 +222,8 @@  static av_always_inline void NAME(TXComplex *out, TXComplex *in,    \
     BF(t[3].im, t[2].re, in[2].re, in[3].re);                       \
     BF(t[3].re, t[2].im, in[2].im, in[3].im);                       \
                                                                     \
-    out[D0*stride].re = dc.re + t[0].re + t[2].re;                  \
-    out[D0*stride].im = dc.im + t[0].im + t[2].im;                  \
+    out[D0*stride].re = dc.re + (TXUSample)t[0].re + t[2].re;        \
+    out[D0*stride].im = dc.im + (TXUSample)t[0].im + t[2].im;        \
                                                                     \
     SMUL(t[4].re, t[0].re, tab[0], tab[2], t[2].re, t[0].re);       \
     SMUL(t[4].im, t[0].im, tab[0], tab[2], t[2].im, t[0].im);       \
@@ -235,14 +235,14 @@  static av_always_inline void NAME(TXComplex *out, TXComplex *in,    \
     BF(z0[2].re, z0[1].re, t[4].re, t[5].re);                       \
     BF(z0[2].im, z0[1].im, t[4].im, t[5].im);                       \
                                                                     \
-    out[D1*stride].re = dc.re + z0[3].re;                           \
-    out[D1*stride].im = dc.im + z0[0].im;                           \
-    out[D2*stride].re = dc.re + z0[2].re;                           \
-    out[D2*stride].im = dc.im + z0[1].im;                           \
-    out[D3*stride].re = dc.re + z0[1].re;                           \
-    out[D3*stride].im = dc.im + z0[2].im;                           \
-    out[D4*stride].re = dc.re + z0[0].re;                           \
-    out[D4*stride].im = dc.im + z0[3].im;                           \
+    out[D1*stride].re = dc.re + (TXUSample)z0[3].re;                 \
+    out[D1*stride].im = dc.im + (TXUSample)z0[0].im;                 \
+    out[D2*stride].re = dc.re + (TXUSample)z0[2].re;                 \
+    out[D2*stride].im = dc.im + (TXUSample)z0[1].im;                 \
+    out[D3*stride].re = dc.re + (TXUSample)z0[1].re;                 \
+    out[D3*stride].im = dc.im + (TXUSample)z0[2].im;                 \
+    out[D4*stride].re = dc.re + (TXUSample)z0[0].re;                 \
+    out[D4*stride].im = dc.im + (TXUSample)z0[3].im;                 \
 }
 
 DECL_FFT5(fft5,     0,  1,  2,  3,  4)