Commit f4affa07 authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/wmalosslessdec: fix overflow with pred in revert_cdlms

Fixes: signed integer overflow: 2048 + 2147483646 cannot be represented in type 'int'
Fixes: 23538/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5227567073460224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 21598d711d894081d0566282473044ba4f378f33)
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent c05d51c0
......@@ -758,7 +758,8 @@ static void lms_update ## bits (WmallDecodeCtx *s, int ich, int ilms, int input)
static void revert_cdlms ## bits (WmallDecodeCtx *s, int ch, \
int coef_begin, int coef_end) \
{ \
int icoef, pred, ilms, num_lms, residue, input; \
int icoef, ilms, num_lms, residue, input; \
unsigned pred;\
\
num_lms = s->cdlms_ttl[ch]; \
for (ilms = num_lms - 1; ilms >= 0; ilms--) { \
......@@ -772,7 +773,7 @@ static void revert_cdlms ## bits (WmallDecodeCtx *s, int ch, \
s->cdlms[ch][ilms].recent, \
FFALIGN(s->cdlms[ch][ilms].order, ROUND), \
WMASIGN(residue)); \
input = residue + (unsigned)(pred >> s->cdlms[ch][ilms].scaling); \
input = residue + (unsigned)((int)pred >> s->cdlms[ch][ilms].scaling); \
lms_update ## bits(s, ch, ilms, input); \
s->channel_residues[ch][icoef] = input; \
} \
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment