diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-05-24 00:21:20 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-05-25 14:29:51 +0200 |
| commit | 5f91786fc8ad9b4108e09e6cbf119d95c8ac4db7 (patch) | |
| tree | 70278fdca6dec15dd495514d241dfb3dbf6220d1 /libavcodec/wavpack.c | |
| parent | 5782e0ba8cc30bb08a806cdeda1adfb89a0556b4 (diff) | |
avcodec/wavpack: Fix: runtime error: signed integer overflow: 3 * -2147483648 cannot be represented in type 'int'
Fixes: 1776/clusterfuzz-testcase-minimized-6191258231898112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/wavpack.c')
| -rw-r--r-- | libavcodec/wavpack.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c index 103a416f28..20774e61d2 100644 --- a/libavcodec/wavpack.c +++ b/libavcodec/wavpack.c @@ -542,9 +542,9 @@ static inline int wv_unpack_mono(WavpackFrameContext *s, GetBitContext *gb, t = s->decorr[i].value; if (t > 8) { if (t & 1) - A = 2 * s->decorr[i].samplesA[0] - s->decorr[i].samplesA[1]; + A = 2U * s->decorr[i].samplesA[0] - s->decorr[i].samplesA[1]; else - A = (3 * s->decorr[i].samplesA[0] - s->decorr[i].samplesA[1]) >> 1; + A = (int)(3U * s->decorr[i].samplesA[0] - s->decorr[i].samplesA[1]) >> 1; s->decorr[i].samplesA[1] = s->decorr[i].samplesA[0]; j = 0; } else { |