Fixes: 2.28595e+09 is outside the range of representable values of type 'int' Fixes: 54644/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AC3_FIXED_fuzzer-4816961584627712
Unified · Split
| @@ -53,6 +53,7 @@ · 52 unmodified lines | |||
| 53 | #define AC3_DYNAMIC_RANGE1 0 | 53 | #define AC3_DYNAMIC_RANGE1 0 |
| 54 | 54 | ||
| 55 | typedef int INTFLOAT; | 55 | typedef int INTFLOAT; |
| 56 | typedef unsigned int UINTFLOAT; | ||
| 56 | typedef int16_t SHORTFLOAT; | 57 | typedef int16_t SHORTFLOAT; |
| 57 | 58 | ||
| 58 | #else /* USE_FIXED */ | 59 | #else /* USE_FIXED */ |
| @@ -73,6 +74,7 @@ typedef int16_t SHORTFLOAT; · 14 unmodified lines | |||
| 73 | #define AC3_DYNAMIC_RANGE1 1.0f | 74 | #define AC3_DYNAMIC_RANGE1 1.0f |
| 74 | 75 | ||
| 75 | typedef float INTFLOAT; | 76 | typedef float INTFLOAT; |
| 77 | typedef float UINTFLOAT; | ||
| 76 | typedef float SHORTFLOAT; | 78 | typedef float SHORTFLOAT; |
| 77 | 79 | ||
| 78 | #endif /* USE_FIXED */ | 80 | #endif /* USE_FIXED */ |
| @@ -138,9 +138,11 @@ static void ff_eac3_apply_spectral_extension(AC3DecodeContext *s) · 137 unmodified lines | |||
| 138 | // spx_noise_blend and spx_signal_blend are both FP.23 | 138 | // spx_noise_blend and spx_signal_blend are both FP.23 |
| 139 | nscale *= 1.0 / (1<<23); | 139 | nscale *= 1.0 / (1<<23); |
| 140 | sscale *= 1.0 / (1<<23); | 140 | sscale *= 1.0 / (1<<23); |
| 141 | if (nscale < -1.0) | ||
| 142 | nscale = -1.0; | ||
| 141 | #endif | 143 | #endif |
| 142 | for (i = 0; i < s->spx_band_sizes[bnd]; i++) { | 144 | for (i = 0; i < s->spx_band_sizes[bnd]; i++) { |
| 143 | float noise = nscale * (int32_t)av_lfg_get(&s->dith_state); | 145 | UINTFLOAT noise = (INTFLOAT)(nscale * (int32_t)av_lfg_get(&s->dith_state)); |
| 144 | s->transform_coeffs[ch][bin] *= sscale; | 146 | s->transform_coeffs[ch][bin] *= sscale; |
| 145 | s->transform_coeffs[ch][bin++] += noise; | 147 | s->transform_coeffs[ch][bin++] += noise; |
| 146 | } | 148 | } |