avcodec/snowdec: Fix runtime error: signed integer overflow: 1404 * 8388608 cannot...
authorMichael Niedermayer <michael@niedermayer.cc>
Fri, 2 Jun 2017 16:13:20 +0000 (18:13 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Fri, 2 Jun 2017 22:09:58 +0000 (00:09 +0200)
Fixes: 2004/clusterfuzz-testcase-minimized-5533262866808832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/snowdec.c

index bcb3469..6cf15c5 100644 (file)
@@ -228,9 +228,9 @@ static void dequantize_slice_buffered(SnowContext *s, slice_buffer * sb, SubBand
         for(x=0; x<w; x++){
             int i= line[x];
             if(i<0){
-                line[x]= -((-i*qmul + qadd)>>(QEXPSHIFT)); //FIXME try different bias
+                line[x]= -((-i*(unsigned)qmul + qadd)>>(QEXPSHIFT)); //FIXME try different bias
             }else if(i>0){
-                line[x]=  (( i*qmul + qadd)>>(QEXPSHIFT));
+                line[x]=  (( i*(unsigned)qmul + qadd)>>(QEXPSHIFT));
             }
         }
     }