From ad2296ab3a131d3560c385e43437841987166804 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 6 May 2017 22:09:59 +0200 Subject: avcodec/aacdec_fixed: Fix various integer overflows Fixes: 1377/clusterfuzz-testcase-minimized-5487049807233024 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/aacdec_template.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'libavcodec/aacdec_template.c') diff --git a/libavcodec/aacdec_template.c b/libavcodec/aacdec_template.c index b20855b99d..d034ae4feb 100644 --- a/libavcodec/aacdec_template.c +++ b/libavcodec/aacdec_template.c @@ -2796,9 +2796,9 @@ static void spectral_to_sample(AACContext *ac, int samples) int j; /* preparation for resampler */ for(j = 0; jch[0].ret[j] = (int32_t)av_clipl_int32((int64_t)che->ch[0].ret[j]<<7)+0x8000; + che->ch[0].ret[j] = (int32_t)av_clip64((int64_t)che->ch[0].ret[j]<<7, INT32_MIN, INT32_MAX-0x8000)+0x8000; if(type == TYPE_CPE) - che->ch[1].ret[j] = (int32_t)av_clipl_int32((int64_t)che->ch[1].ret[j]<<7)+0x8000; + che->ch[1].ret[j] = (int32_t)av_clip64((int64_t)che->ch[1].ret[j]<<7, INT32_MIN, INT32_MAX-0x8000)+0x8000; } } #endif /* USE_FIXED */ -- cgit v1.2.3