Re: [FFmpeg-devel] [flac] Fix integer-overflow in flac_lpc_33_c

[Michael Niedermayer <michael@niedermayer.cc>]

[-- Attachment #1.1: Type: text/plain, Size: 1364 bytes --]

Hi Dale

On Tue, Jul 29, 2025 at 03:07:38PM -0700, Dale Curtis wrote:
> This fix copies a couple of casts from surrounding functions.
> See https://crbug.com/432528781 for stack trace details.
> 
> Signed-off-by: Dale Curtis <dalecurtis@chromium.org>

>  flacdsp.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 187b2fdeaecb08d3683b90875f4d7c0e74a38da1  flac_fix_v1.patch
> From 0bf245bf8a031d12aec77e68dbc627247255eeb0 Mon Sep 17 00:00:00 2001
> From: Dale Curtis <dalecurtis@chromium.org>
> Date: Tue, 29 Jul 2025 22:05:19 +0000
> Subject: [PATCH] [flac] Fix integer-overflow in flac_lpc_33_c
> 
> This fix copies a couple of casts from surrounding functions.

> See https://crbug.com/432528781 for stack trace details.

You (email=michael@niedermayer.cc) are not authorized to access this page!


[...]

> -        decoded[j] = residual[i] + (sum >> qlevel);
> +        decoded[j] = (uint64_t)residual[i] + (unsigned)(sum >> qlevel);

This does not give the same result for cases that do not overflow

I would guess more in the direction of:

        decoded[j] = (int64_t)residual[i] + (uint64_t)(sum >> qlevel);


thx

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

During times of universal deceit, telling the truth becomes a
revolutionary act. -- George Orwell

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".