MrBesen
/
ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avcodec/wmalosslessdec: Fix several integer issues 

Fixes: shift exponent -1 is negative (and others)
Fixes: 18852/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5660855295541248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-11-18 14:22:57 +01:00
parent 9d42826580
commit ec3fe67074
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/wmalosslessdec.c
View File

@ -678,7 +678,7 @@ static void mclms_predict(WmallDecodeCtx *s, int icoef, int *pred)
for (i = 0; i < ich; i++)
pred[ich] += (uint32_t)s->channel_residues[i][icoef] *
s->mclms_coeffs_cur[i + num_channels * ich];
pred[ich] += 1 << s->mclms_scaling - 1;
pred[ich] += (1 << s->mclms_scaling) >> 1;
pred[ich] >>= s->mclms_scaling;
s->channel_residues[ich][icoef] += pred[ich];
}
@ -811,19 +811,19 @@ static void revert_acfilter(WmallDecodeCtx *s, int tile_size)
pred = 0;
for (j = 0; j < order; j++) {
if (i <= j)
pred += filter_coeffs[j] * prevvalues[j - i];
pred += (uint32_t)filter_coeffs[j] * prevvalues[j - i];
else
pred += s->channel_residues[ich][i - j - 1] * filter_coeffs[j];
pred += (uint32_t)s->channel_residues[ich][i - j - 1] * filter_coeffs[j];
}
pred >>= scaling;
s->channel_residues[ich][i] += pred;
s->channel_residues[ich][i] += (unsigned)pred;
}
for (i = order; i < tile_size; i++) {
pred = 0;
for (j = 0; j < order; j++)
pred += (uint32_t)s->channel_residues[ich][i - j - 1] * filter_coeffs[j];
pred >>= scaling;
s->channel_residues[ich][i] += pred;
s->channel_residues[ich][i] += (unsigned)pred;
}
for (j = 0; j < order; j++)
prevvalues[j] = s->channel_residues[ich][tile_size - j - 1];