From bacc4b6e8173fa944c24f297435dc507a60efb10 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 16 May 2016 13:14:31 +0200 Subject: [PATCH] avcodec/wmalosslessdec: Use unsigned operations for overflowing cases Fixes undefined behavior in fate-lossless-wma24-2 Signed-off-by: Michael Niedermayer --- libavcodec/lossless_audiodsp.c | 4 ++-- libavcodec/wmalosslessdec.c | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/libavcodec/lossless_audiodsp.c b/libavcodec/lossless_audiodsp.c index e3ea8e188c..3a9f9b20bb 100644 --- a/libavcodec/lossless_audiodsp.c +++ b/libavcodec/lossless_audiodsp.c @@ -45,9 +45,9 @@ static int32_t scalarproduct_and_madd_int32_c(int16_t *v1, const int32_t *v2, int res = 0; do { - res += *v1 * *v2++; + res += *v1 * (uint32_t)*v2++; *v1++ += mul * *v3++; - res += *v1 * *v2++; + res += *v1 * (uint32_t)*v2++; *v1++ += mul * *v3++; } while (order-=2); return res; diff --git a/libavcodec/wmalosslessdec.c b/libavcodec/wmalosslessdec.c index 1ea5918b1f..eb94ed8b82 100644 --- a/libavcodec/wmalosslessdec.c +++ b/libavcodec/wmalosslessdec.c @@ -674,10 +674,10 @@ static void mclms_predict(WmallDecodeCtx *s, int icoef, int *pred) if (!s->is_channel_coded[ich]) continue; for (i = 0; i < order * num_channels; i++) - pred[ich] += s->mclms_prevvalues[i + s->mclms_recent] * + pred[ich] += (uint32_t)s->mclms_prevvalues[i + s->mclms_recent] * s->mclms_coeffs[i + order * num_channels * ich]; for (i = 0; i < ich; i++) - pred[ich] += s->channel_residues[i][icoef] * + pred[ich] += (uint32_t)s->channel_residues[i][icoef] * s->mclms_coeffs_cur[i + num_channels * ich]; pred[ich] += 1 << s->mclms_scaling - 1; pred[ich] >>= s->mclms_scaling; @@ -822,7 +822,7 @@ static void revert_acfilter(WmallDecodeCtx *s, int tile_size) for (i = order; i < tile_size; i++) { pred = 0; for (j = 0; j < order; j++) - pred += s->channel_residues[ich][i - j - 1] * filter_coeffs[j]; + pred += (uint32_t)s->channel_residues[ich][i - j - 1] * filter_coeffs[j]; pred >>= scaling; s->channel_residues[ich][i] += pred; }