diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2015-09-02 20:43:25 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2015-09-02 20:45:07 +0200 |
| commit | cf818be4f2f1e06bf63da3a6b55a4c3620952070 (patch) | |
| tree | 8c48de9884f5b9a38901d2d67e5357cb3a159f80 /libavcodec | |
| parent | 95010d49a2daf782cba7a261bde5c979cfd51c67 (diff) | |
avcodec/truemotion1: Fix undefined behavior (left shift of negative value)
Fixes: asan_heap-oob_26f6853_862_cov_585961513_sonic3dblast_intro-partial.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/truemotion1.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/libavcodec/truemotion1.c b/libavcodec/truemotion1.c index eed3a37bba..14c964da38 100644 --- a/libavcodec/truemotion1.c +++ b/libavcodec/truemotion1.c @@ -215,7 +215,7 @@ static int make_cdt16_entry(int p1, int p2, int16_t *cdt) b = cdt[p2]; r = cdt[p1] << 11; lo = b + r; - return (lo + (lo << 16)) << 1; + return (lo + (lo * (1 << 16))) * 2; } static int make_ydt24_entry(int p1, int p2, int16_t *ydt) @@ -224,7 +224,7 @@ static int make_ydt24_entry(int p1, int p2, int16_t *ydt) lo = ydt[p1]; hi = ydt[p2]; - return (lo + (hi << 8) + (hi << 16)) << 1; + return (lo + (hi * (1 << 8)) + (hi * (1 << 16))) * 2; } static int make_cdt24_entry(int p1, int p2, int16_t *cdt) @@ -232,8 +232,8 @@ static int make_cdt24_entry(int p1, int p2, int16_t *cdt) int r, b; b = cdt[p2]; - r = cdt[p1]<<16; - return (b+r) << 1; + r = cdt[p1] * (1 << 16); + return (b+r) * 2; } static void gen_vector_table15(TrueMotion1Context *s, const uint8_t *sel_vector_table) |