diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-03-08 21:41:34 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-03-09 23:28:10 +0100 |
| commit | 800d02abe041deacab5585bf41c1bc2ae5f4b922 (patch) | |
| tree | 3f729d8894fe2c799a875d32d4706079b35b48e5 /libavcodec/mjpegdec.c | |
| parent | 58dd25f8adb151a59971daa94d352d3226d2dbb6 (diff) | |
avcodec/mjpegdec: Fix runtime error: left shift of negative value -127
Fixes: 733/clusterfuzz-testcase-4682158096515072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/mjpegdec.c')
| -rw-r--r-- | libavcodec/mjpegdec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index 2b5adfc61b..4e78e1e3ae 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -1196,13 +1196,13 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor, PREDICT(pred, ptr[-linesize-1], ptr[-linesize], ptr[-1], predictor); pred &= mask; - *ptr = pred + (dc << point_transform); + *ptr = pred + ((unsigned)dc << point_transform); }else{ ptr16 = (uint16_t*)(s->picture_ptr->data[c] + 2*(linesize * (v * mb_y + y)) + 2*(h * mb_x + x)); //FIXME optimize this crap PREDICT(pred, ptr16[-linesize-1], ptr16[-linesize], ptr16[-1], predictor); pred &= mask; - *ptr16= pred + (dc << point_transform); + *ptr16= pred + ((unsigned)dc << point_transform); } if (++x == h) { |