wavpack: Fix 32-bit clipping
authorDerek Buitenhuis <derek.buitenhuis@gmail.com>
Fri, 16 Dec 2011 18:31:29 +0000 (13:31 -0500)
committerMichael Niedermayer <michaelni@gmx.at>
Tue, 3 Jan 2012 18:04:14 +0000 (19:04 +0100)
In the case that (frame_flags & 0x03) == 3, hybrid_maxclip
may have had a signed integer overflow.

Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit bb9747c8eee134f2bf6058d368f8cbc799f4b7d3)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/wavpack.c

index 9f1ce34..8d9b804 100644 (file)
@@ -408,7 +408,7 @@ static inline int wv_get_value_integer(WavpackFrameContext *s, uint32_t *crc, in
     bit = (((S + bit) << s->shift) - bit) << s->post_shift;
 
     if(s->hybrid)
-        bit = av_clip(bit, -s->hybrid_maxclip, s->hybrid_maxclip - 1);
+        bit = av_clip(bit, -s->hybrid_maxclip - 1, s->hybrid_maxclip);
 
     return bit;
 }
@@ -798,7 +798,7 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no,
     s->joint = s->frame_flags & WV_JOINT_STEREO;
     s->hybrid = s->frame_flags & WV_HYBRID_MODE;
     s->hybrid_bitrate = s->frame_flags & WV_HYBRID_BITRATE;
-    s->hybrid_maxclip = 1 << ((((s->frame_flags & 0x03) + 1) << 3) - 1);
+    s->hybrid_maxclip = (1LL << ((((s->frame_flags & 0x03) + 1) << 3) - 1)) - 1;
     s->post_shift = 8 * (bpp-1-(s->frame_flags&0x03)) + ((s->frame_flags >> 13) & 0x1f);
     s->CRC = AV_RL32(buf); buf += 4;
     if(wc->mkv_mode)