highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/osq: avoid several signed integer overflows

Browse Source 
Fixes: signed integer overflow: 178459578 + 2009763270 cannot be represented in type 'int'
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-5013423686287360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2023-12-26 00:33:02 +01:00
parent e83e8d443b
commit b54c9a9c8f
1 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
libavcodec/osq.c
View File

@@ -221,8 +221,8 @@ static int osq_channel_parameters(AVCodecContext *avctx, int ch)
#define C (-3) #define C (-3)
#define D (-4) #define D (-4)
#define E (-5) #define E (-5)
#define P2 ((dst[A] + dst[A]) - dst[B]) #define P2 (((unsigned)dst[A] + dst[A]) - dst[B])
#define P3 ((dst[A] - dst[B]) * 3 + dst[C]) #define P3 (((unsigned)dst[A] - dst[B]) * 3 + dst[C])
static int do_decode(AVCodecContext *avctx, AVFrame *frame, int decorrelate, int downsample) static int do_decode(AVCodecContext *avctx, AVFrame *frame, int decorrelate, int downsample)
{ {
@@ -272,10 +272,10 @@ static int do_decode(AVCodecContext *avctx, AVFrame *frame, int decorrelate, int
case 0: case 0:
break; break;
case 1: case 1:
dst[n] += dst[A]; dst[n] += (unsigned)dst[A];
break; break;
case 2: case 2:
dst[n] += dst[A] + p; dst[n] += (unsigned)dst[A] + p;
break; break;
case 3: case 3:
dst[n] += P2; dst[n] += P2;
@@ -290,28 +290,28 @@ static int do_decode(AVCodecContext *avctx, AVFrame *frame, int decorrelate, int
dst[n] += P3 + p; dst[n] += P3 + p;
break; break;
case 7: case 7:
dst[n] += (P2 + P3) / 2 + p; dst[n] += (int)(P2 + P3) / 2 + (unsigned)p;
break; break;
case 8: case 8:
dst[n] += (P2 + P3) / 2; dst[n] += (int)(P2 + P3) / 2;
break; break;
case 9: case 9:
dst[n] += (P2 * 2 + P3) / 3 + p; dst[n] += (int)(P2 * 2 + P3) / 3 + (unsigned)p;
break; break;
case 10: case 10:
dst[n] += (P2 + P3 * 2) / 3 + p; dst[n] += (int)(P2 + P3 * 2) / 3 + (unsigned)p;
break; break;
case 11: case 11:
dst[n] += (dst[A] + dst[B]) / 2; dst[n] += (int)((unsigned)dst[A] + dst[B]) / 2;
break; break;
case 12: case 12:
dst[n] += dst[B]; dst[n] += (unsigned)dst[B];
break; break;
case 13: case 13:
dst[n] += (dst[D] + dst[B]) / 2; dst[n] += (int)(unsigned)(dst[D] + dst[B]) / 2;
break; break;
case 14: case 14:
dst[n] += (P2 + dst[A]) / 2 + p; dst[n] += (int)((unsigned)P2 + dst[A]) / 2 + (unsigned)p;
break; break;
default: default:
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;