Fixes: signed integer overflow: -1027919784 + -1120041624 cannot be represented in type 'int' Fixes: 15406/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5700646528876544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> --- libavcodec/simple_idct_template.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/libavcodec/simple_idct_template.c b/libavcodec/simple_idct_template.c index 35c31321c6..90d1c21355 100644 --- a/libavcodec/simple_idct_template.c +++ b/libavcodec/simple_idct_template.c @@ -312,18 +312,18 @@ static inline void FUNC6(idctSparseColAdd)(pixel *dest, ptrdiff_t line_size, static inline void FUNC6(idctSparseCol)(idctin *col) #endif { - int a0, a1, a2, a3, b0, b1, b2, b3; + unsigned a0, a1, a2, a3, b0, b1, b2, b3; IDCT_COLS; - col[0 ] = ((a0 + b0) >> COL_SHIFT); - col[8 ] = ((a1 + b1) >> COL_SHIFT); - col[16] = ((a2 + b2) >> COL_SHIFT); - col[24] = ((a3 + b3) >> COL_SHIFT); - col[32] = ((a3 - b3) >> COL_SHIFT); - col[40] = ((a2 - b2) >> COL_SHIFT); - col[48] = ((a1 - b1) >> COL_SHIFT); - col[56] = ((a0 - b0) >> COL_SHIFT); + col[0 ] = ((int)(a0 + b0) >> COL_SHIFT); + col[8 ] = ((int)(a1 + b1) >> COL_SHIFT); + col[16] = ((int)(a2 + b2) >> COL_SHIFT); + col[24] = ((int)(a3 + b3) >> COL_SHIFT); + col[32] = ((int)(a3 - b3) >> COL_SHIFT); + col[40] = ((int)(a2 - b2) >> COL_SHIFT); + col[48] = ((int)(a1 - b1) >> COL_SHIFT); + col[56] = ((int)(a0 - b0) >> COL_SHIFT); } #ifndef EXTRA_SHIFT -- 2.22.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
