| Message ID | 20230920003034.7241-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 35e6960a6be42ec27de6a3f070071ab7e2e3f27d |
| Headers | show |
| Series | [FFmpeg-devel,1/5] avcodec/flacdec: Fix overflow in "33bit" decorrelate | expand |
| Context | Check | Description |
|---|---|---|
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
On Wed, Sep 20, 2023 at 02:30:30AM +0200, Michael Niedermayer wrote: > Fixes: signed integer overflow: 538976288 - -9223372036854775808 cannot be represented in type 'long' > Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-6275845531238400 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/flacdec.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) will apply patchset [...]
diff --git a/libavcodec/flacdec.c b/libavcodec/flacdec.c index 524a0469495..0569f019b3a 100644 --- a/libavcodec/flacdec.c +++ b/libavcodec/flacdec.c @@ -706,10 +706,10 @@ static void decorrelate_33bps(int ch_mode, int32_t **decoded, int64_t *decoded_3 int i; if (ch_mode == FLAC_CHMODE_LEFT_SIDE ) { for (i = 0; i < len; i++) - decoded[1][i] = decoded[0][i] - decoded_33bps[i]; + decoded[1][i] = decoded[0][i] - (uint64_t)decoded_33bps[i]; } else if (ch_mode == FLAC_CHMODE_RIGHT_SIDE ) { for (i = 0; i < len; i++) - decoded[0][i] = decoded[1][i] + decoded_33bps[i]; + decoded[0][i] = decoded[1][i] + (uint64_t)decoded_33bps[i]; } else if (ch_mode == FLAC_CHMODE_MID_SIDE ) { for (i = 0; i < len; i++) { uint64_t a = decoded[0][i];
Fixes: signed integer overflow: 538976288 - -9223372036854775808 cannot be represented in type 'long' Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-6275845531238400 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/flacdec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)