Commit 3c702517 authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/jpeg2000dwt: Fix integer overflows in sr_1d97_int()

Fixes: runtime error: signed integer overflow: 1157259380 + 1157259380 cannot be represented in type 'int'
Fixes: 2365/clusterfuzz-testcase-minimized-6020421927305216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent ea536667
......@@ -464,16 +464,16 @@ static void sr_1d97_int(int32_t *p, int i0, int i1)
extend97_int(p, i0, i1);
for (i = (i0 >> 1) - 1; i < (i1 >> 1) + 2; i++)
p[2 * i] -= (I_LFTG_DELTA * (p[2 * i - 1] + p[2 * i + 1]) + (1 << 15)) >> 16;
p[2 * i] -= (I_LFTG_DELTA * (p[2 * i - 1] + (int64_t)p[2 * i + 1]) + (1 << 15)) >> 16;
/* step 4 */
for (i = (i0 >> 1) - 1; i < (i1 >> 1) + 1; i++)
p[2 * i + 1] -= (I_LFTG_GAMMA * (p[2 * i] + p[2 * i + 2]) + (1 << 15)) >> 16;
p[2 * i + 1] -= (I_LFTG_GAMMA * (p[2 * i] + (int64_t)p[2 * i + 2]) + (1 << 15)) >> 16;
/*step 5*/
for (i = (i0 >> 1); i < (i1 >> 1) + 1; i++)
p[2 * i] += (I_LFTG_BETA * (p[2 * i - 1] + p[2 * i + 1]) + (1 << 15)) >> 16;
p[2 * i] += (I_LFTG_BETA * (p[2 * i - 1] + (int64_t)p[2 * i + 1]) + (1 << 15)) >> 16;
/* step 6 */
for (i = (i0 >> 1); i < (i1 >> 1); i++)
p[2 * i + 1] += (I_LFTG_ALPHA * (p[2 * i] + p[2 * i + 2]) + (1 << 15)) >> 16;
p[2 * i + 1] += (I_LFTG_ALPHA * (p[2 * i] + (int64_t)p[2 * i + 2]) + (1 << 15)) >> 16;
}
static void dwt_decode97_int(DWTContext *s, int32_t *t)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment