From 47db5763e21c5e3b0ddde2430d15938f8d88480d Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 28 Jul 2018 10:59:09 +0200
Subject: [PATCH] avcodec/aacpsdsp_template: Fix integer overflow in
ps_stereo_interpolate_c()
Fixes: signed integer overflow: -1813244069 + -1407981383 cannot be represented in type 'int'
Fixes: 8823/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5643295618236416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/aacpsdsp_template.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/libavcodec/aacpsdsp_template.c b/libavcodec/aacpsdsp_template.c
index 65867649c7c..5f4be017d57 100644
--- a/libavcodec/aacpsdsp_template.c
+++ b/libavcodec/aacpsdsp_template.c
@@ -150,10 +150,10 @@ static void ps_stereo_interpolate_c(INTFLOAT (*l)[2], INTFLOAT (*r)[2],
INTFLOAT h1 = h[0][1];
INTFLOAT h2 = h[0][2];
INTFLOAT h3 = h[0][3];
- INTFLOAT hs0 = h_step[0][0];
- INTFLOAT hs1 = h_step[0][1];
- INTFLOAT hs2 = h_step[0][2];
- INTFLOAT hs3 = h_step[0][3];
+ UINTFLOAT hs0 = h_step[0][0];
+ UINTFLOAT hs1 = h_step[0][1];
+ UINTFLOAT hs2 = h_step[0][2];
+ UINTFLOAT hs3 = h_step[0][3];
int n;
for (n = 0; n < len; n++) {
--
GitLab