Commit fd313d8c authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/ralf: Fix integer overflow in apply_lpc()

Fixes: signed integer overflow: 2147482897 + 2048 cannot be represented in type 'int'
Fixes: 19240/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5743240326414336
Fixes: 19869/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5150136636538880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent bfea054a
...@@ -330,7 +330,7 @@ static void apply_lpc(RALFContext *ctx, int ch, int length, int bits) ...@@ -330,7 +330,7 @@ static void apply_lpc(RALFContext *ctx, int ch, int length, int bits)
acc = (acc + bias - 1) >> ctx->filter_bits; acc = (acc + bias - 1) >> ctx->filter_bits;
acc = FFMAX(acc, min_clip); acc = FFMAX(acc, min_clip);
} else { } else {
acc = (acc + bias) >> ctx->filter_bits; acc = ((unsigned)acc + bias) >> ctx->filter_bits;
acc = FFMIN(acc, max_clip); acc = FFMIN(acc, max_clip);
} }
audio[i] += acc; audio[i] += acc;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment