avcodec/wmalosslessdec: Use unsigned operations for overflowing cases
authorMichael Niedermayer <michael@niedermayer.cc>
Mon, 16 May 2016 11:14:31 +0000 (13:14 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Mon, 6 Jun 2016 00:24:22 +0000 (02:24 +0200)
Fixes undefined behavior in fate-lossless-wma24-2

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/lossless_audiodsp.c
libavcodec/wmalosslessdec.c

index e3ea8e1..3a9f9b2 100644 (file)
@@ -45,9 +45,9 @@ static int32_t scalarproduct_and_madd_int32_c(int16_t *v1, const int32_t *v2,
     int res = 0;
 
     do {
-        res   += *v1 * *v2++;
+        res   += *v1 * (uint32_t)*v2++;
         *v1++ += mul * *v3++;
-        res   += *v1 * *v2++;
+        res   += *v1 * (uint32_t)*v2++;
         *v1++ += mul * *v3++;
     } while (order-=2);
     return res;
index 1ea5918..eb94ed8 100644 (file)
@@ -674,10 +674,10 @@ static void mclms_predict(WmallDecodeCtx *s, int icoef, int *pred)
         if (!s->is_channel_coded[ich])
             continue;
         for (i = 0; i < order * num_channels; i++)
-            pred[ich] += s->mclms_prevvalues[i + s->mclms_recent] *
+            pred[ich] += (uint32_t)s->mclms_prevvalues[i + s->mclms_recent] *
                          s->mclms_coeffs[i + order * num_channels * ich];
         for (i = 0; i < ich; i++)
-            pred[ich] += s->channel_residues[i][icoef] *
+            pred[ich] += (uint32_t)s->channel_residues[i][icoef] *
                          s->mclms_coeffs_cur[i + num_channels * ich];
         pred[ich] += 1 << s->mclms_scaling - 1;
         pred[ich] >>= s->mclms_scaling;
@@ -822,7 +822,7 @@ static void revert_acfilter(WmallDecodeCtx *s, int tile_size)
         for (i = order; i < tile_size; i++) {
             pred = 0;
             for (j = 0; j < order; j++)
-                pred += s->channel_residues[ich][i - j - 1] * filter_coeffs[j];
+                pred += (uint32_t)s->channel_residues[ich][i - j - 1] * filter_coeffs[j];
             pred >>= scaling;
             s->channel_residues[ich][i] += pred;
         }