highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/aacpsdsp_template: Fix integer overflow in ps_stereo_interpolate_c()

Browse Source 
Fixes: signed integer overflow: -1813244069 + -1407981383 cannot be represented in type 'int'
Fixes: 8823/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5643295618236416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2018-07-28 10:59:09 +02:00
parent 6b67d7f059
commit 47db5763e2
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/aacpsdsp_template.c
View File

@ -150,10 +150,10 @@ static void ps_stereo_interpolate_c(INTFLOAT (*l)[2], INTFLOAT (*r)[2],
INTFLOAT h1 = h[0][1]; INTFLOAT h1 = h[0][1];
INTFLOAT h2 = h[0][2]; INTFLOAT h2 = h[0][2];
INTFLOAT h3 = h[0][3]; INTFLOAT h3 = h[0][3];
INTFLOAT hs0 = h_step[0][0]; UINTFLOAT hs0 = h_step[0][0];
INTFLOAT hs1 = h_step[0][1]; UINTFLOAT hs1 = h_step[0][1];
INTFLOAT hs2 = h_step[0][2]; UINTFLOAT hs2 = h_step[0][2];
INTFLOAT hs3 = h_step[0][3]; UINTFLOAT hs3 = h_step[0][3];
int n; int n;
for (n = 0; n < len; n++) { for (n = 0; n < len; n++) {