Fixes: signed integer overflow: -1082982400 + -1195645138 cannot be represented in type 'int' Fixes: 376136843/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-4791844321427456
Unified · Split
| @@ -1355,9 +1355,9 @@ yuv2rgba64_full_X_c_template(SwsInternal *c, const int16_t *lumFilter, · 1354 unmodified lines | ||
| 1355 | 1355 | B = U * c->yuv2rgb_u2b_coeff; |
| 1356 | 1356 | |
| 1357 | 1357 | // 8bit: 30 - 22 = 8bit, 16bit: 30bit - 14 = 16bit |
| 1358 | − output_pixel(&dest[0], av_clip_uintp2(((R_B + Y)>>14) + (1<<15), 16)); | |
| 1359 | − output_pixel(&dest[1], av_clip_uintp2((( G + Y)>>14) + (1<<15), 16)); | |
| 1360 | − output_pixel(&dest[2], av_clip_uintp2(((B_R + Y)>>14) + (1<<15), 16)); | |
| 1358 | + output_pixel(&dest[0], av_clip_uintp2(((int)(R_B + (unsigned)Y)>>14) + (1<<15), 16)); | |
| 1359 | + output_pixel(&dest[1], av_clip_uintp2(((int)( G + (unsigned)Y)>>14) + (1<<15), 16)); | |
| 1360 | + output_pixel(&dest[2], av_clip_uintp2(((int)(B_R + (unsigned)Y)>>14) + (1<<15), 16)); | |
| 1361 | 1361 | if (eightbytes) { |
| 1362 | 1362 | output_pixel(&dest[3], av_clip_uintp2(A, 30) >> 14); |
| 1363 | 1363 | dest += 4; |