(the exact issue is unreproducable but the use of uninitialized data is reproducable) Should fix: signed integer overflow: -2147483648 - 127 cannot be represented in type 'int' Should fix: 69881/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-4751301204836352
Unified · Split
| @@ -2110,8 +2110,8 @@ static av_cold int decode_init(AVCodecContext *avctx) · 2109 unmodified lines | |||
| 2110 | 2110 | ||
| 2111 | if (sconf->floating) { | 2111 | if (sconf->floating) { |
| 2112 | ctx->acf = av_malloc_array(channels, sizeof(*ctx->acf)); | 2112 | ctx->acf = av_malloc_array(channels, sizeof(*ctx->acf)); |
| 2113 | ctx->shift_value = av_malloc_array(channels, sizeof(*ctx->shift_value)); | 2113 | ctx->shift_value = av_calloc(channels, sizeof(*ctx->shift_value)); |
| 2114 | ctx->last_shift_value = av_malloc_array(channels, sizeof(*ctx->last_shift_value)); | 2114 | ctx->last_shift_value = av_calloc(channels, sizeof(*ctx->last_shift_value)); |
| 2115 | ctx->last_acf_mantissa = av_malloc_array(channels, sizeof(*ctx->last_acf_mantissa)); | 2115 | ctx->last_acf_mantissa = av_malloc_array(channels, sizeof(*ctx->last_acf_mantissa)); |
| 2116 | ctx->raw_mantissa = av_calloc(channels, sizeof(*ctx->raw_mantissa)); | 2116 | ctx->raw_mantissa = av_calloc(channels, sizeof(*ctx->raw_mantissa)); |
| 2117 | 2117 | ||