History

avcodec/sbrdsp_fixed: Fix undefined overflows in autocorrelate()

Fixes: runtime error: signed integer overflow: 8903997421129740175 + 354481484684609529 cannot be represented in type 'long' Fixes: 2045/clusterfuzz-testcase-minimized-6751255865065472

Michael Niedermayer committed 9 years ago

Commit eefb68c1 parent 4f05e2e1 file · +18 −18Browse files

Unified · Split

libavcodec/sbrdsp_fixed.c+18−18
@@ -147,19 +147,19 @@ static av_always_inline void autocorrelate(const int x[40][2], SoftFloat phi[3][ · 146 unmodified lines
147147
148148 if (lag) {
149149 for (i = 1; i < 38; i++) {
150− accu_re += (int64_t)x[i][0] * x[i+lag][0];
151− accu_re += (int64_t)x[i][1] * x[i+lag][1];
152− accu_im += (int64_t)x[i][0] * x[i+lag][1];
153− accu_im -= (int64_t)x[i][1] * x[i+lag][0];
150+ accu_re += (uint64_t)x[i][0] * x[i+lag][0];
151+ accu_re += (uint64_t)x[i][1] * x[i+lag][1];
152+ accu_im += (uint64_t)x[i][0] * x[i+lag][1];
153+ accu_im -= (uint64_t)x[i][1] * x[i+lag][0];
154154 }
155155
156156 real_sum = accu_re;
157157 imag_sum = accu_im;
158158
159− accu_re += (int64_t)x[ 0][0] * x[lag][0];
160− accu_re += (int64_t)x[ 0][1] * x[lag][1];
161− accu_im += (int64_t)x[ 0][0] * x[lag][1];
162− accu_im -= (int64_t)x[ 0][1] * x[lag][0];
159+ accu_re += (uint64_t)x[ 0][0] * x[lag][0];
160+ accu_re += (uint64_t)x[ 0][1] * x[lag][1];
161+ accu_im += (uint64_t)x[ 0][0] * x[lag][1];
162+ accu_im -= (uint64_t)x[ 0][1] * x[lag][0];
163163
164164 phi[2-lag][1][0] = autocorr_calc(accu_re);
165165 phi[2-lag][1][1] = autocorr_calc(accu_im);
@@ -167,28 +167,28 @@ static av_always_inline void autocorrelate(const int x[40][2], SoftFloat phi[3][ · 1 unmodified line
167167 if (lag == 1) {
168168 accu_re = real_sum;
169169 accu_im = imag_sum;
170− accu_re += (int64_t)x[38][0] * x[39][0];
171− accu_re += (int64_t)x[38][1] * x[39][1];
172− accu_im += (int64_t)x[38][0] * x[39][1];
173− accu_im -= (int64_t)x[38][1] * x[39][0];
170+ accu_re += (uint64_t)x[38][0] * x[39][0];
171+ accu_re += (uint64_t)x[38][1] * x[39][1];
172+ accu_im += (uint64_t)x[38][0] * x[39][1];
173+ accu_im -= (uint64_t)x[38][1] * x[39][0];
174174
175175 phi[0][0][0] = autocorr_calc(accu_re);
176176 phi[0][0][1] = autocorr_calc(accu_im);
177177 }
178178 } else {
179179 for (i = 1; i < 38; i++) {
180− accu_re += (int64_t)x[i][0] * x[i][0];
181− accu_re += (int64_t)x[i][1] * x[i][1];
180+ accu_re += (uint64_t)x[i][0] * x[i][0];
181+ accu_re += (uint64_t)x[i][1] * x[i][1];
182182 }
183183 real_sum = accu_re;
184− accu_re += (int64_t)x[ 0][0] * x[ 0][0];
185− accu_re += (int64_t)x[ 0][1] * x[ 0][1];
184+ accu_re += (uint64_t)x[ 0][0] * x[ 0][0];
185+ accu_re += (uint64_t)x[ 0][1] * x[ 0][1];
186186
187187 phi[2][1][0] = autocorr_calc(accu_re);
188188
189189 accu_re = real_sum;
190− accu_re += (int64_t)x[38][0] * x[38][0];
191− accu_re += (int64_t)x[38][1] * x[38][1];
190+ accu_re += (uint64_t)x[38][0] * x[38][0];
191+ accu_re += (uint64_t)x[38][1] * x[38][1];
192192
193193 phi[1][0][0] = autocorr_calc(accu_re);
194194 }

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t