avcodec/apedec: Fix integer overflow in filter_3800()
authorMichael Niedermayer <michael@niedermayer.cc>
Sun, 20 Oct 2019 22:26:25 +0000 (00:26 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Sat, 9 Nov 2019 16:26:09 +0000 (17:26 +0100)
Fixes: signed integer overflow: 2117181180 + 60483298 cannot be represented in type 'int'
Fixes: 18344/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5685327791915008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/apedec.c

index 2250f29..cfcf9a0 100644 (file)
@@ -885,7 +885,7 @@ static av_always_inline int filter_3800(APEPredictor *p,
     p->coeffsB[filter][1] -= (((d4 >> 30) & 2) - 1) * sign;
 
     p->filterB[filter] = p->lastA[filter] + (predictionB >> shift);
-    p->filterA[filter] = p->filterB[filter] + ((int)(p->filterA[filter] * 31U) >> 5);
+    p->filterA[filter] = p->filterB[filter] + (unsigned)((int)(p->filterA[filter] * 31U) >> 5);
 
     return p->filterA[filter];
 }