avcodec/lagarith: fix integer overflow
authorMichael Niedermayer <michaelni@gmx.at>
Tue, 11 Nov 2014 02:19:11 +0000 (03:19 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Tue, 11 Nov 2014 02:19:49 +0000 (03:19 +0100)
Fixes: asan_heap-oob_1bf48fa_2513_lag-yuy2.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/lagarith.c

index 5f97d0f806d60b8e98c053bce0969ca961f8ff8f..2c6d70c0650b6f920b77bbcb0e0e8d98e18fc1b5 100644 (file)
@@ -128,7 +128,7 @@ static int lag_decode_prob(GetBitContext *gb, uint32_t *value)
     }
 
     val  = get_bits_long(gb, bits);
-    val |= 1 << bits;
+    val |= 1U << bits;
 
     *value = val - 1;