Fixes: 2.28595e+09 is outside the range of representable values of type 'int' Fixes: 54644/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AC3_FIXED_fuzzer-4816961584627712
Showing the changes to libavcodec (2 of 2 files). Show all
Unified · Split
| @@ -53,6 +53,7 @@ · 52 unmodified lines | ||
| 53 | 53 | #define AC3_DYNAMIC_RANGE1 0 |
| 54 | 54 | |
| 55 | 55 | typedef int INTFLOAT; |
| 56 | +typedef unsigned int UINTFLOAT; | |
| 56 | 57 | typedef int16_t SHORTFLOAT; |
| 57 | 58 | |
| 58 | 59 | #else /* USE_FIXED */ |
| @@ -73,6 +74,7 @@ typedef int16_t SHORTFLOAT; · 14 unmodified lines | ||
| 73 | 74 | #define AC3_DYNAMIC_RANGE1 1.0f |
| 74 | 75 | |
| 75 | 76 | typedef float INTFLOAT; |
| 77 | +typedef float UINTFLOAT; | |
| 76 | 78 | typedef float SHORTFLOAT; |
| 77 | 79 | |
| 78 | 80 | #endif /* USE_FIXED */ |
| @@ -138,9 +138,11 @@ static void ff_eac3_apply_spectral_extension(AC3DecodeContext *s) · 137 unmodified lines | ||
| 138 | 138 | // spx_noise_blend and spx_signal_blend are both FP.23 |
| 139 | 139 | nscale *= 1.0 / (1<<23); |
| 140 | 140 | sscale *= 1.0 / (1<<23); |
| 141 | + if (nscale < -1.0) | |
| 142 | + nscale = -1.0; | |
| 141 | 143 | #endif |
| 142 | 144 | for (i = 0; i < s->spx_band_sizes[bnd]; i++) { |
| 143 | − float noise = nscale * (int32_t)av_lfg_get(&s->dith_state); | |
| 145 | + UINTFLOAT noise = (INTFLOAT)(nscale * (int32_t)av_lfg_get(&s->dith_state)); | |
| 144 | 146 | s->transform_coeffs[ch][bin] *= sscale; |
| 145 | 147 | s->transform_coeffs[ch][bin++] += noise; |
| 146 | 148 | } |