xenia-project/FFmpeg
1
0
Fork 0
mirror of https://github.com/xenia-project/FFmpeg.git synced 2024-11-25 20:50:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

avcodec/truemotion1: Fix undefined behavior (left shift of negative value)

Browse Source 
Fixes: asan_heap-oob_26f6853_862_cov_585961513_sonic3dblast_intro-partial.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2015-09-02 20:43:25 +02:00
parent 95010d49a2
commit cf818be4f2
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/truemotion1.c
View File

@ -215,7 +215,7 @@ static int make_cdt16_entry(int p1, int p2, int16_t *cdt)
b = cdt[p2];
r = cdt[p1] << 11;
lo = b + r;
return (lo + (lo << 16)) << 1;
return (lo + (lo * (1 << 16))) * 2;
}
static int make_ydt24_entry(int p1, int p2, int16_t *ydt)
@ -224,7 +224,7 @@ static int make_ydt24_entry(int p1, int p2, int16_t *ydt)
lo = ydt[p1];
hi = ydt[p2];
return (lo + (hi << 8) + (hi << 16)) << 1;
return (lo + (hi * (1 << 8)) + (hi * (1 << 16))) * 2;
}
static int make_cdt24_entry(int p1, int p2, int16_t *cdt)
@ -232,8 +232,8 @@ static int make_cdt24_entry(int p1, int p2, int16_t *cdt)
int r, b;
b = cdt[p2];
r = cdt[p1]<<16;
return (b+r) << 1;
r = cdt[p1] * (1 << 16);
return (b+r) * 2;
}
static void gen_vector_table15(TrueMotion1Context *s, const uint8_t *sel_vector_table)