Fixes: signed integer overflow: -277109688 * 8 cannot be represented in type 'int' Fixes: 376118159/clusterfuzz-testcase-minimized-ffmpeg_SWR_fuzzer-5884436320681984
Unified · Split
| @@ -98,7 +98,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { · 97 unmodified lines | |||
| 98 | av_channel_layout_copy(& in_ch_layout, &layouts[bytestream2_get_byte(&gbc) % FF_ARRAY_ELEMS(layouts)]); | 98 | av_channel_layout_copy(& in_ch_layout, &layouts[bytestream2_get_byte(&gbc) % FF_ARRAY_ELEMS(layouts)]); |
| 99 | av_channel_layout_copy(&out_ch_layout, &layouts[bytestream2_get_byte(&gbc) % FF_ARRAY_ELEMS(layouts)]); | 99 | av_channel_layout_copy(&out_ch_layout, &layouts[bytestream2_get_byte(&gbc) % FF_ARRAY_ELEMS(layouts)]); |
| 100 | 100 | ||
| 101 | out_sample_nb = bytestream2_get_le32(&gbc); | 101 | out_sample_nb = bytestream2_get_le32(&gbc) & 0x7FFFFFFF; |
| 102 | 102 | ||
| 103 | flags64 = bytestream2_get_le64(&gbc); | 103 | flags64 = bytestream2_get_le64(&gbc); |
| 104 | if (flags64 & 0x10) | 104 | if (flags64 & 0x10) |