Commit 382b4fc9 authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/svq3: Increase offsets to prevent integer overflows

Fixes: 1280/clusterfuzz-testcase-minimized-6102353767825408

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpegSigned-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent a75ef150
...@@ -562,8 +562,8 @@ static inline int svq3_mc_dir(SVQ3Context *s, int size, int mode, ...@@ -562,8 +562,8 @@ static inline int svq3_mc_dir(SVQ3Context *s, int size, int mode,
int fx, fy; int fx, fy;
mx = (mx + 1 >> 1) + dx; mx = (mx + 1 >> 1) + dx;
my = (my + 1 >> 1) + dy; my = (my + 1 >> 1) + dy;
fx = (unsigned)(mx + 0x3000) / 3 - 0x1000; fx = (unsigned)(mx + 0x30000) / 3 - 0x10000;
fy = (unsigned)(my + 0x3000) / 3 - 0x1000; fy = (unsigned)(my + 0x30000) / 3 - 0x10000;
dxy = (mx - 3 * fx) + 4 * (my - 3 * fy); dxy = (mx - 3 * fx) + 4 * (my - 3 * fy);
svq3_mc_dir_part(s, x, y, part_width, part_height, svq3_mc_dir_part(s, x, y, part_width, part_height,
...@@ -571,8 +571,8 @@ static inline int svq3_mc_dir(SVQ3Context *s, int size, int mode, ...@@ -571,8 +571,8 @@ static inline int svq3_mc_dir(SVQ3Context *s, int size, int mode,
mx += mx; mx += mx;
my += my; my += my;
} else if (mode == HALFPEL_MODE || mode == PREDICT_MODE) { } else if (mode == HALFPEL_MODE || mode == PREDICT_MODE) {
mx = (unsigned)(mx + 1 + 0x3000) / 3 + dx - 0x1000; mx = (unsigned)(mx + 1 + 0x30000) / 3 + dx - 0x10000;
my = (unsigned)(my + 1 + 0x3000) / 3 + dy - 0x1000; my = (unsigned)(my + 1 + 0x30000) / 3 + dy - 0x10000;
dxy = (mx & 1) + 2 * (my & 1); dxy = (mx & 1) + 2 * (my & 1);
svq3_mc_dir_part(s, x, y, part_width, part_height, svq3_mc_dir_part(s, x, y, part_width, part_height,
...@@ -580,8 +580,8 @@ static inline int svq3_mc_dir(SVQ3Context *s, int size, int mode, ...@@ -580,8 +580,8 @@ static inline int svq3_mc_dir(SVQ3Context *s, int size, int mode,
mx *= 3; mx *= 3;
my *= 3; my *= 3;
} else { } else {
mx = (unsigned)(mx + 3 + 0x6000) / 6 + dx - 0x1000; mx = (unsigned)(mx + 3 + 0x60000) / 6 + dx - 0x10000;
my = (unsigned)(my + 3 + 0x6000) / 6 + dy - 0x1000; my = (unsigned)(my + 3 + 0x60000) / 6 + dy - 0x10000;
svq3_mc_dir_part(s, x, y, part_width, part_height, svq3_mc_dir_part(s, x, y, part_width, part_height,
mx, my, 0, 0, dir, avg); mx, my, 0, 0, dir, avg);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment