diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-10-05 19:52:53 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-10-25 00:22:33 +0200 |
| commit | 42eb78059d149abcd994f46c8b8a0dd98e86b594 (patch) | |
| tree | 034b5e720d6c19f2a7e868099768aa6c6a1cc0d2 /libavcodec/takdec.c | |
| parent | 37d8ae9da8ac9f3dd01d30996b538c82ba4d8085 (diff) | |
avcodec/takdec: Fix overflow with large sample rates
Fixes: signed integer overflow: 2147483647 + 511 cannot be represented in type 'int'
Fixes: 17899/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5719753322135552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/takdec.c')
| -rw-r--r-- | libavcodec/takdec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/takdec.c b/libavcodec/takdec.c index 4fb5825532..8ec87ab509 100644 --- a/libavcodec/takdec.c +++ b/libavcodec/takdec.c @@ -176,8 +176,8 @@ static void set_sample_rate_params(AVCodecContext *avctx) } else { shift = 0; } - s->uval = FFALIGN(avctx->sample_rate + 511 >> 9, 4) << shift; - s->subframe_scale = FFALIGN(avctx->sample_rate + 511 >> 9, 4) << 1; + s->uval = FFALIGN(avctx->sample_rate + 511LL >> 9, 4) << shift; + s->subframe_scale = FFALIGN(avctx->sample_rate + 511LL >> 9, 4) << 1; } static av_cold int tak_decode_init(AVCodecContext *avctx) |