History

avcodec/aacsbr_fixed: Fix multiple runtime error: left shift of negative value -407

Fixes: 1674/clusterfuzz-testcase-minimized-6092531563495424 Fixes: 1686/clusterfuzz-testcase-minimized-6282691643179008

Michael Niedermayer committed 9 years ago

Commit 2ccd2c91 parent 55b56a83 files · +8 −8Browse files

Unified · Split

3 files
  1. libavcodec/aacdec_template.c +2 −2
  2. libavcodec/aacsbr_fixed.c +4 −4
  3. libavcodec/sbrdsp_fixed.c +2 −2
libavcodec/aacdec_template.c+2−2
@@ -2800,9 +2800,9 @@ static void spectral_to_sample(AACContext *ac, int samples) · 2799 unmodified lines
2800 int j;2800 int j;
2801 /* preparation for resampler */2801 /* preparation for resampler */
2802 for(j = 0; j<samples; j++){2802 for(j = 0; j<samples; j++){
2803 che->ch[0].ret[j] = (int32_t)av_clip64((int64_t)che->ch[0].ret[j]<<7, INT32_MIN, INT32_MAX-0x8000)+0x8000;2803 che->ch[0].ret[j] = (int32_t)av_clip64((int64_t)che->ch[0].ret[j]*128, INT32_MIN, INT32_MAX-0x8000)+0x8000;
2804 if(type == TYPE_CPE)2804 if(type == TYPE_CPE)
2805 che->ch[1].ret[j] = (int32_t)av_clip64((int64_t)che->ch[1].ret[j]<<7, INT32_MIN, INT32_MAX-0x8000)+0x8000;2805 che->ch[1].ret[j] = (int32_t)av_clip64((int64_t)che->ch[1].ret[j]*128, INT32_MIN, INT32_MAX-0x8000)+0x8000;
2806 }2806 }
2807 }2807 }
2808#endif /* USE_FIXED */2808#endif /* USE_FIXED */
libavcodec/aacsbr_fixed.c+4−4
@@ -289,7 +289,7 @@ static void sbr_hf_inverse_filter(SBRDSPContext *dsp, · 288 unmodified lines
289 if (shift >= 3)289 if (shift >= 3)
290 alpha0[k][0] = 0x7fffffff;290 alpha0[k][0] = 0x7fffffff;
291 else {291 else {
292 a00.mant <<= 1;292 a00.mant *= 2;
293 shift = 2-shift;293 shift = 2-shift;
294 if (shift == 0)294 if (shift == 0)
295 alpha0[k][0] = a00.mant;295 alpha0[k][0] = a00.mant;
@@ -303,7 +303,7 @@ static void sbr_hf_inverse_filter(SBRDSPContext *dsp, · 7 unmodified lines
303 if (shift >= 3)303 if (shift >= 3)
304 alpha0[k][1] = 0x7fffffff;304 alpha0[k][1] = 0x7fffffff;
305 else {305 else {
306 a01.mant <<= 1;306 a01.mant *= 2;
307 shift = 2-shift;307 shift = 2-shift;
308 if (shift == 0)308 if (shift == 0)
309 alpha0[k][1] = a01.mant;309 alpha0[k][1] = a01.mant;
@@ -316,7 +316,7 @@ static void sbr_hf_inverse_filter(SBRDSPContext *dsp, · 6 unmodified lines
316 if (shift >= 3)316 if (shift >= 3)
317 alpha1[k][0] = 0x7fffffff;317 alpha1[k][0] = 0x7fffffff;
318 else {318 else {
319 a10.mant <<= 1;319 a10.mant *= 2;
320 shift = 2-shift;320 shift = 2-shift;
321 if (shift == 0)321 if (shift == 0)
322 alpha1[k][0] = a10.mant;322 alpha1[k][0] = a10.mant;
@@ -330,7 +330,7 @@ static void sbr_hf_inverse_filter(SBRDSPContext *dsp, · 7 unmodified lines
330 if (shift >= 3)330 if (shift >= 3)
331 alpha1[k][1] = 0x7fffffff;331 alpha1[k][1] = 0x7fffffff;
332 else {332 else {
333 a11.mant <<= 1;333 a11.mant *= 2;
334 shift = 2-shift;334 shift = 2-shift;
335 if (shift == 0)335 if (shift == 0)
336 alpha1[k][1] = a11.mant;336 alpha1[k][1] = a11.mant;
libavcodec/sbrdsp_fixed.c+2−2
@@ -116,7 +116,7 @@ static av_always_inline SoftFloat autocorr_calc(int64_t accu) · 115 unmodified lines
116 } else {116 } else {
117 nz = 0;117 nz = 0;
118 while (FFABS(i) < 0x40000000) {118 while (FFABS(i) < 0x40000000) {
119 i <<= 1;119 i *= 2;
120 nz++;120 nz++;
121 }121 }
122 nz = 32-nz;122 nz = 32-nz;
@@ -125,7 +125,7 @@ static av_always_inline SoftFloat autocorr_calc(int64_t accu) · 2 unmodified lines
125 round = 1U << (nz-1);125 round = 1U << (nz-1);
126 mant = (int)((accu + round) >> nz);126 mant = (int)((accu + round) >> nz);
127 mant = (mant + 0x40)>>7;127 mant = (mant + 0x40)>>7;
128 mant <<= 6;128 mant *= 64;
129 expo = nz + 15;129 expo = nz + 15;
130 return av_int2sf(mant, 30 - expo);130 return av_int2sf(mant, 30 - expo);
131}131}

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t