[FFmpeg-devel] [PATCH 2/5] avcodec/cdgraphics: avoid signed overflow in alpha

[Andreas Rheinhardt]

Michael Niedermayer:
> Fixes: left shift of 255 by 24 places cannot be represented in type 'int'
> Fixes: 42766/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CDGRAPHICS_fuzzer-5142826105569280
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/cdgraphics.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavcodec/cdgraphics.c b/libavcodec/cdgraphics.c
> index 06f83920943..f54ce5a05c0 100644
> --- a/libavcodec/cdgraphics.c
> +++ b/libavcodec/cdgraphics.c
> @@ -122,7 +122,7 @@ static void cdg_load_palette(CDGraphicsContext *cc, uint8_t *data, int low)
>          r = ((color >> 8) & 0x000F) * 17;
>          g = ((color >> 4) & 0x000F) * 17;
>          b = ((color     ) & 0x000F) * 17;
> -        palette[i + array_offset] = cc->alpha[i + array_offset] << 24 | r << 16 | g << 8 | b;
> +        palette[i + array_offset] = (unsigned)cc->alpha[i + array_offset] << 24 | r << 16 | g << 8 | b;
>      }
>      cc->frame->palette_has_changed = 1;
>  }
> 

LGTM. Although I'd prefer uint32_t here, as this is exactly what is
needed and it fits the type of palette.

- Andreas