ffmpeg | branch: master | Michael Niedermayer <mich...@niedermayer.cc> | Mon Jun 26 15:00:52 2017 +0200| [3c70251780647d49e09522bbe22758c841e37a9a] | committer: Michael Niedermayer
avcodec/jpeg2000dwt: Fix integer overflows in sr_1d97_int() Fixes: runtime error: signed integer overflow: 1157259380 + 1157259380 cannot be represented in type 'int' Fixes: 2365/clusterfuzz-testcase-minimized-6020421927305216 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3c70251780647d49e09522bbe22758c841e37a9a --- libavcodec/jpeg2000dwt.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavcodec/jpeg2000dwt.c b/libavcodec/jpeg2000dwt.c index e4aa2e4a3d..55dd5e89b5 100644 --- a/libavcodec/jpeg2000dwt.c +++ b/libavcodec/jpeg2000dwt.c @@ -464,16 +464,16 @@ static void sr_1d97_int(int32_t *p, int i0, int i1) extend97_int(p, i0, i1); for (i = (i0 >> 1) - 1; i < (i1 >> 1) + 2; i++) - p[2 * i] -= (I_LFTG_DELTA * (p[2 * i - 1] + p[2 * i + 1]) + (1 << 15)) >> 16; + p[2 * i] -= (I_LFTG_DELTA * (p[2 * i - 1] + (int64_t)p[2 * i + 1]) + (1 << 15)) >> 16; /* step 4 */ for (i = (i0 >> 1) - 1; i < (i1 >> 1) + 1; i++) - p[2 * i + 1] -= (I_LFTG_GAMMA * (p[2 * i] + p[2 * i + 2]) + (1 << 15)) >> 16; + p[2 * i + 1] -= (I_LFTG_GAMMA * (p[2 * i] + (int64_t)p[2 * i + 2]) + (1 << 15)) >> 16; /*step 5*/ for (i = (i0 >> 1); i < (i1 >> 1) + 1; i++) - p[2 * i] += (I_LFTG_BETA * (p[2 * i - 1] + p[2 * i + 1]) + (1 << 15)) >> 16; + p[2 * i] += (I_LFTG_BETA * (p[2 * i - 1] + (int64_t)p[2 * i + 1]) + (1 << 15)) >> 16; /* step 6 */ for (i = (i0 >> 1); i < (i1 >> 1); i++) - p[2 * i + 1] += (I_LFTG_ALPHA * (p[2 * i] + p[2 * i + 2]) + (1 << 15)) >> 16; + p[2 * i + 1] += (I_LFTG_ALPHA * (p[2 * i] + (int64_t)p[2 * i + 2]) + (1 << 15)) >> 16; } static void dwt_decode97_int(DWTContext *s, int32_t *t) _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
