[FFmpeg-devel] [PATCH 1/4] avcodec/wavarc: Fix several integer overflows

[Michael Niedermayer <michael@niedermayer.cc>]

Fixes: signed integer overflow: -532410125 + -1759642300 cannot be represented in type 'int'
Fixes: 57045/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-637023665297817

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/wavarc.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavcodec/wavarc.c b/libavcodec/wavarc.c
index 8d37af95716..896972cec82 100644
--- a/libavcodec/wavarc.c
+++ b/libavcodec/wavarc.c
@@ -349,7 +349,7 @@ static int decode_2slp(AVCodecContext *avctx,
                 int sum = 15;
 
                 for (int o = 0; o < order; o++)
-                    sum += s->filter[ch][o] * samples[n + 70 - o - 1];
+                    sum += s->filter[ch][o] * (unsigned)samples[n + 70 - o - 1];
 
                 samples[n + 70] = get_srice(gb, k) + (sum >> 4);
             }
@@ -452,7 +452,7 @@ fail:
             const int *src = s->samples[ch] + s->offset;
 
             for (int n = 0; n < frame->nb_samples; n++)
-                dst[n] = src[n] * (1 << s->shift) + 0x80U;
+                dst[n] = src[n] * (1U << s->shift) + 0x80U;
         }
         break;
     case AV_SAMPLE_FMT_S16P:
@@ -461,7 +461,7 @@ fail:
             const int *src = s->samples[ch] + s->offset;
 
             for (int n = 0; n < frame->nb_samples; n++)
-                dst[n] = src[n] * (1 << s->shift);
+                dst[n] = src[n] * (1U << s->shift);
         }
         break;
     }
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".