[FFmpeg-devel] [PATCH 2/4] avcodec/osq: Fixes several undefined overflows in do_decode()
Michael Niedermayer
michael at niedermayer.cc
Sun Dec 1 06:03:04 EET 2024
Fixes: signed integer overflow: 1239596184 + 2119376059 cannot be represented in type 'int'
Fixes: 376136844/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6581164455821312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
libavcodec/osq.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavcodec/osq.c b/libavcodec/osq.c
index 1bf62646994..83b4a9d618d 100644
--- a/libavcodec/osq.c
+++ b/libavcodec/osq.c
@@ -300,7 +300,7 @@ static int do_decode(AVCodecContext *avctx, AVFrame *frame, int decorrelate, int
dst[n] += (int)(P2 + P3) / 2 + (unsigned)p;
break;
case 8:
- dst[n] += (int)(P2 + P3) / 2;
+ dst[n] += (int)(P2 + P3) / 2 + 0U;
break;
case 9:
dst[n] += (int)(P2 * 2 + P3) / 3 + (unsigned)p;
@@ -309,13 +309,13 @@ static int do_decode(AVCodecContext *avctx, AVFrame *frame, int decorrelate, int
dst[n] += (int)(P2 + P3 * 2) / 3 + (unsigned)p;
break;
case 11:
- dst[n] += (int)((unsigned)dst[A] + dst[B]) / 2;
+ dst[n] += (int)((unsigned)dst[A] + dst[B]) / 2 + 0U;
break;
case 12:
dst[n] += (unsigned)dst[B];
break;
case 13:
- dst[n] += (int)(unsigned)(dst[D] + dst[B]) / 2;
+ dst[n] += (int)((unsigned)dst[D] + dst[B]) / 2 + 0U;
break;
case 14:
dst[n] += (int)((unsigned)P2 + dst[A]) / 2 + (unsigned)p;
--
2.47.0
More information about the ffmpeg-devel
mailing list