[FFmpeg-cvslog] avcodec/mpeg4videodec: Fix overflow in virtual_ref computation
Michael Niedermayer
git at videolan.org
Wed Jul 19 17:55:45 EEST 2017
ffmpeg | branch: release/3.3 | Michael Niedermayer <michael at niedermayer.cc> | Tue Jun 20 13:52:06 2017 +0200| [ada21bca5551977ab00c5a799b20dbff544ac3f9] | committer: Michael Niedermayer
avcodec/mpeg4videodec: Fix overflow in virtual_ref computation
Fixes: runtime error: signed integer overflow: 262144 * -16120 cannot be represented in type 'int'
Fixes: 2292/clusterfuzz-testcase-minimized-6156080415506432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 5443c4bdf4828ac5b7b19cf54feb496c2da40079)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ada21bca5551977ab00c5a799b20dbff544ac3f9
---
libavcodec/mpeg4videodec.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
index 99680dabc3..d2f22dd372 100644
--- a/libavcodec/mpeg4videodec.c
+++ b/libavcodec/mpeg4videodec.c
@@ -243,18 +243,18 @@ static int mpeg4_decode_sprite_trajectory(Mpeg4DecContext *ctx, GetBitContext *g
* from w&h based to w2&h2 based which are of the 2^x form. */
virtual_ref[0][0] = 16 * (vop_ref[0][0] + w2) +
ROUNDED_DIV(((w - w2) *
- (r * sprite_ref[0][0] - 16 * vop_ref[0][0]) +
- w2 * (r * sprite_ref[1][0] - 16 * vop_ref[1][0])), w);
+ (r * sprite_ref[0][0] - 16LL * vop_ref[0][0]) +
+ w2 * (r * sprite_ref[1][0] - 16LL * vop_ref[1][0])), w);
virtual_ref[0][1] = 16 * vop_ref[0][1] +
ROUNDED_DIV(((w - w2) *
- (r * sprite_ref[0][1] - 16 * vop_ref[0][1]) +
- w2 * (r * sprite_ref[1][1] - 16 * vop_ref[1][1])), w);
+ (r * sprite_ref[0][1] - 16LL * vop_ref[0][1]) +
+ w2 * (r * sprite_ref[1][1] - 16LL * vop_ref[1][1])), w);
virtual_ref[1][0] = 16 * vop_ref[0][0] +
- ROUNDED_DIV(((h - h2) * (r * sprite_ref[0][0] - 16 * vop_ref[0][0]) +
- h2 * (r * sprite_ref[2][0] - 16 * vop_ref[2][0])), h);
+ ROUNDED_DIV(((h - h2) * (r * sprite_ref[0][0] - 16LL * vop_ref[0][0]) +
+ h2 * (r * sprite_ref[2][0] - 16LL * vop_ref[2][0])), h);
virtual_ref[1][1] = 16 * (vop_ref[0][1] + h2) +
- ROUNDED_DIV(((h - h2) * (r * sprite_ref[0][1] - 16 * vop_ref[0][1]) +
- h2 * (r * sprite_ref[2][1] - 16 * vop_ref[2][1])), h);
+ ROUNDED_DIV(((h - h2) * (r * sprite_ref[0][1] - 16LL * vop_ref[0][1]) +
+ h2 * (r * sprite_ref[2][1] - 16LL * vop_ref[2][1])), h);
switch (ctx->num_sprite_warping_points) {
case 0:
More information about the ffmpeg-cvslog
mailing list