[FFmpeg-cvslog] avcodec/qdmc: Fix integer overflows in PRNG
Michael Niedermayer
git at videolan.org
Thu Jun 27 20:49:42 EEST 2019
ffmpeg | branch: release/4.1 | Michael Niedermayer <michael at niedermayer.cc> | Sun Jun 16 15:53:27 2019 +0200| [d00e33ed3a2127901b622081b364580144be12c4] | committer: Michael Niedermayer
avcodec/qdmc: Fix integer overflows in PRNG
Fixes: signed integer overflow: 214013 * 2531011 cannot be represented in type 'int'
Fixes: 15254/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDMC_fuzzer-5698137026461696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 2921b45a388a81968d946996bb32e72d7bb5d5b7)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d00e33ed3a2127901b622081b364580144be12c4
---
libavcodec/qdmc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/qdmc.c b/libavcodec/qdmc.c
index 8f5b7b920d..8bea1552e1 100644
--- a/libavcodec/qdmc.c
+++ b/libavcodec/qdmc.c
@@ -577,9 +577,9 @@ static void add_noise(QDMCContext *s, int ch, int current_subframe)
for (j = 2; j < s->subframe_size - 1; j++) {
float rnd_re, rnd_im;
- s->rndval = 214013 * s->rndval + 2531011;
+ s->rndval = 214013U * s->rndval + 2531011;
rnd_im = ((s->rndval & 0x7FFF) - 16384.0f) * 0.000030517578f * s->noise2_buffer[j];
- s->rndval = 214013 * s->rndval + 2531011;
+ s->rndval = 214013U * s->rndval + 2531011;
rnd_re = ((s->rndval & 0x7FFF) - 16384.0f) * 0.000030517578f * s->noise2_buffer[j];
im[j ] += rnd_im;
re[j ] += rnd_re;
More information about the ffmpeg-cvslog
mailing list