avcodec/qdmc: Fix integer overflows in PRNG
authorMichael Niedermayer <michael@niedermayer.cc>
Sun, 16 Jun 2019 13:53:27 +0000 (15:53 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Thu, 27 Jun 2019 15:50:47 +0000 (17:50 +0200)
Fixes: signed integer overflow: 214013 * 2531011 cannot be represented in type 'int'
Fixes: 15254/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDMC_fuzzer-5698137026461696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2921b45a388a81968d946996bb32e72d7bb5d5b7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/qdmc.c

index 8f5b7b9..8bea155 100644 (file)
@@ -577,9 +577,9 @@ static void add_noise(QDMCContext *s, int ch, int current_subframe)
     for (j = 2; j < s->subframe_size - 1; j++) {
         float rnd_re, rnd_im;
 
-        s->rndval = 214013 * s->rndval + 2531011;
+        s->rndval = 214013U * s->rndval + 2531011;
         rnd_im = ((s->rndval & 0x7FFF) - 16384.0f) * 0.000030517578f * s->noise2_buffer[j];
-        s->rndval = 214013 * s->rndval + 2531011;
+        s->rndval = 214013U * s->rndval + 2531011;
         rnd_re = ((s->rndval & 0x7FFF) - 16384.0f) * 0.000030517578f * s->noise2_buffer[j];
         im[j  ] += rnd_im;
         re[j  ] += rnd_re;