har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/aacdec_fixed: Fix runtime error: left shift of negative value -1

Browse Source 
Fixes: 1535/clusterfuzz-testcase-minimized-5826695535788032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-05-13 18:13:48 +02:00
parent 87b08ee6d2
commit 26227d9186
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/aacdec_fixed.c
View File

@ -125,7 +125,7 @@ static inline int *DEC_SQUAD(int *dst, unsigned idx)
static inline int *DEC_UPAIR(int *dst, unsigned idx, unsigned sign) static inline int *DEC_UPAIR(int *dst, unsigned idx, unsigned sign)
{ {
dst[0] = (idx & 15) * (1 - (sign & 0xFFFFFFFE)); dst[0] = (idx & 15) * (1 - (sign & 0xFFFFFFFE));
dst[1] = (idx >> 4 & 15) * (1 - ((sign & 1) << 1)); dst[1] = (idx >> 4 & 15) * (1 - ((sign & 1) * 2));
return dst + 2; return dst + 2;
} }
@ -134,16 +134,16 @@ static inline int *DEC_UQUAD(int *dst, unsigned idx, unsigned sign)
{ {
unsigned nz = idx >> 12; unsigned nz = idx >> 12;
dst[0] = (idx & 3) * (1 + (((int)sign >> 31) << 1)); dst[0] = (idx & 3) * (1 + (((int)sign >> 31) * 2));
sign <<= nz & 1; sign <<= nz & 1;
nz >>= 1; nz >>= 1;
dst[1] = (idx >> 2 & 3) * (1 + (((int)sign >> 31) << 1)); dst[1] = (idx >> 2 & 3) * (1 + (((int)sign >> 31) * 2));
sign <<= nz & 1; sign <<= nz & 1;
nz >>= 1; nz >>= 1;
dst[2] = (idx >> 4 & 3) * (1 + (((int)sign >> 31) << 1)); dst[2] = (idx >> 4 & 3) * (1 + (((int)sign >> 31) * 2));
sign <<= nz & 1; sign <<= nz & 1;
nz >>= 1; nz >>= 1;
dst[3] = (idx >> 6 & 3) * (1 + (((int)sign >> 31) << 1)); dst[3] = (idx >> 6 & 3) * (1 + (((int)sign >> 31) * 2));
return dst + 4; return dst + 4;
} }