[FFmpeg-cvslog] avcodec/jpeg2000dwt: Fix integer overflows in sr_1d97_int()

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Mon Jun 26 15:00:52 2017 +0200| [3c70251780647d49e09522bbe22758c841e37a9a] | committer: Michael Niedermayer

avcodec/jpeg2000dwt: Fix integer overflows in sr_1d97_int()

Fixes: runtime error: signed integer overflow: 1157259380 + 1157259380 cannot be represented in type 'int'
Fixes: 2365/clusterfuzz-testcase-minimized-6020421927305216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3c70251780647d49e09522bbe22758c841e37a9a
---

 libavcodec/jpeg2000dwt.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/libavcodec/jpeg2000dwt.c b/libavcodec/jpeg2000dwt.c
index e4aa2e4a3d..55dd5e89b5 100644
--- a/libavcodec/jpeg2000dwt.c
+++ b/libavcodec/jpeg2000dwt.c
@@ -464,16 +464,16 @@ static void sr_1d97_int(int32_t *p, int i0, int i1)
     extend97_int(p, i0, i1);
 
     for (i = (i0 >> 1) - 1; i < (i1 >> 1) + 2; i++)
-        p[2 * i]     -= (I_LFTG_DELTA * (p[2 * i - 1] + p[2 * i + 1]) + (1 << 15)) >> 16;
+        p[2 * i]     -= (I_LFTG_DELTA * (p[2 * i - 1] + (int64_t)p[2 * i + 1]) + (1 << 15)) >> 16;
     /* step 4 */
     for (i = (i0 >> 1) - 1; i < (i1 >> 1) + 1; i++)
-        p[2 * i + 1] -= (I_LFTG_GAMMA * (p[2 * i]     + p[2 * i + 2]) + (1 << 15)) >> 16;
+        p[2 * i + 1] -= (I_LFTG_GAMMA * (p[2 * i]     + (int64_t)p[2 * i + 2]) + (1 << 15)) >> 16;
     /*step 5*/
     for (i = (i0 >> 1); i < (i1 >> 1) + 1; i++)
-        p[2 * i]     += (I_LFTG_BETA  * (p[2 * i - 1] + p[2 * i + 1]) + (1 << 15)) >> 16;
+        p[2 * i]     += (I_LFTG_BETA  * (p[2 * i - 1] + (int64_t)p[2 * i + 1]) + (1 << 15)) >> 16;
     /* step 6 */
     for (i = (i0 >> 1); i < (i1 >> 1); i++)
-        p[2 * i + 1] += (I_LFTG_ALPHA * (p[2 * i]     + p[2 * i + 2]) + (1 << 15)) >> 16;
+        p[2 * i + 1] += (I_LFTG_ALPHA * (p[2 * i]     + (int64_t)p[2 * i + 2]) + (1 << 15)) >> 16;
 }
 
 static void dwt_decode97_int(DWTContext *s, int32_t *t)