Commit b789ebf6 authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/h264_cavlc: Fix integer overflows with motion vector residual addition

Fixes: signed integer overflow: 14 + 2147483647 cannot be represented in type 'int'
Fixes: 14794/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5677380695228416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent c5f265bb
...@@ -923,8 +923,8 @@ decode_intra_mb: ...@@ -923,8 +923,8 @@ decode_intra_mb:
const int index= 4*i + block_width*j; const int index= 4*i + block_width*j;
int16_t (* mv_cache)[2]= &sl->mv_cache[list][ scan8[index] ]; int16_t (* mv_cache)[2]= &sl->mv_cache[list][ scan8[index] ];
pred_motion(h, sl, index, block_width, list, sl->ref_cache[list][ scan8[index] ], &mx, &my); pred_motion(h, sl, index, block_width, list, sl->ref_cache[list][ scan8[index] ], &mx, &my);
mx += get_se_golomb(&sl->gb); mx += (unsigned)get_se_golomb(&sl->gb);
my += get_se_golomb(&sl->gb); my += (unsigned)get_se_golomb(&sl->gb);
ff_tlog(h->avctx, "final mv:%d %d\n", mx, my); ff_tlog(h->avctx, "final mv:%d %d\n", mx, my);
if(IS_SUB_8X8(sub_mb_type)){ if(IS_SUB_8X8(sub_mb_type)){
...@@ -977,8 +977,8 @@ decode_intra_mb: ...@@ -977,8 +977,8 @@ decode_intra_mb:
for (list = 0; list < sl->list_count; list++) { for (list = 0; list < sl->list_count; list++) {
if(IS_DIR(mb_type, 0, list)){ if(IS_DIR(mb_type, 0, list)){
pred_motion(h, sl, 0, 4, list, sl->ref_cache[list][ scan8[0] ], &mx, &my); pred_motion(h, sl, 0, 4, list, sl->ref_cache[list][ scan8[0] ], &mx, &my);
mx += get_se_golomb(&sl->gb); mx += (unsigned)get_se_golomb(&sl->gb);
my += get_se_golomb(&sl->gb); my += (unsigned)get_se_golomb(&sl->gb);
ff_tlog(h->avctx, "final mv:%d %d\n", mx, my); ff_tlog(h->avctx, "final mv:%d %d\n", mx, my);
fill_rectangle(sl->mv_cache[list][ scan8[0] ], 4, 4, 8, pack16to32(mx,my), 4); fill_rectangle(sl->mv_cache[list][ scan8[0] ], 4, 4, 8, pack16to32(mx,my), 4);
...@@ -1012,8 +1012,8 @@ decode_intra_mb: ...@@ -1012,8 +1012,8 @@ decode_intra_mb:
unsigned int val; unsigned int val;
if(IS_DIR(mb_type, i, list)){ if(IS_DIR(mb_type, i, list)){
pred_16x8_motion(h, sl, 8*i, list, sl->ref_cache[list][scan8[0] + 16*i], &mx, &my); pred_16x8_motion(h, sl, 8*i, list, sl->ref_cache[list][scan8[0] + 16*i], &mx, &my);
mx += get_se_golomb(&sl->gb); mx += (unsigned)get_se_golomb(&sl->gb);
my += get_se_golomb(&sl->gb); my += (unsigned)get_se_golomb(&sl->gb);
ff_tlog(h->avctx, "final mv:%d %d\n", mx, my); ff_tlog(h->avctx, "final mv:%d %d\n", mx, my);
val= pack16to32(mx,my); val= pack16to32(mx,my);
...@@ -1050,8 +1050,8 @@ decode_intra_mb: ...@@ -1050,8 +1050,8 @@ decode_intra_mb:
unsigned int val; unsigned int val;
if(IS_DIR(mb_type, i, list)){ if(IS_DIR(mb_type, i, list)){
pred_8x16_motion(h, sl, i*4, list, sl->ref_cache[list][ scan8[0] + 2*i ], &mx, &my); pred_8x16_motion(h, sl, i*4, list, sl->ref_cache[list][ scan8[0] + 2*i ], &mx, &my);
mx += get_se_golomb(&sl->gb); mx += (unsigned)get_se_golomb(&sl->gb);
my += get_se_golomb(&sl->gb); my += (unsigned)get_se_golomb(&sl->gb);
ff_tlog(h->avctx, "final mv:%d %d\n", mx, my); ff_tlog(h->avctx, "final mv:%d %d\n", mx, my);
val= pack16to32(mx,my); val= pack16to32(mx,my);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment