History

avcodec/sbrdsp_fixed: Fix undefined overflows in autocorrelate()

Fixes: runtime error: signed integer overflow: 8903997421129740175 + 354481484684609529 cannot be represented in type 'long' Fixes: 2045/clusterfuzz-testcase-minimized-6751255865065472

Michael Niedermayer committed 9 years ago

Commit eefb68c1 parent 4f05e2e1 file · +18 −18Browse files

Unified · Split

libavcodec/sbrdsp_fixed.c+18−18
@@ -147,19 +147,19 @@ static av_always_inline void autocorrelate(const int x[40][2], SoftFloat phi[3][ · 146 unmodified lines
147 147
148 if (lag) {148 if (lag) {
149 for (i = 1; i < 38; i++) {149 for (i = 1; i < 38; i++) {
150 accu_re += (int64_t)x[i][0] * x[i+lag][0];150 accu_re += (uint64_t)x[i][0] * x[i+lag][0];
151 accu_re += (int64_t)x[i][1] * x[i+lag][1];151 accu_re += (uint64_t)x[i][1] * x[i+lag][1];
152 accu_im += (int64_t)x[i][0] * x[i+lag][1];152 accu_im += (uint64_t)x[i][0] * x[i+lag][1];
153 accu_im -= (int64_t)x[i][1] * x[i+lag][0];153 accu_im -= (uint64_t)x[i][1] * x[i+lag][0];
154 }154 }
155 155
156 real_sum = accu_re;156 real_sum = accu_re;
157 imag_sum = accu_im;157 imag_sum = accu_im;
158 158
159 accu_re += (int64_t)x[ 0][0] * x[lag][0];159 accu_re += (uint64_t)x[ 0][0] * x[lag][0];
160 accu_re += (int64_t)x[ 0][1] * x[lag][1];160 accu_re += (uint64_t)x[ 0][1] * x[lag][1];
161 accu_im += (int64_t)x[ 0][0] * x[lag][1];161 accu_im += (uint64_t)x[ 0][0] * x[lag][1];
162 accu_im -= (int64_t)x[ 0][1] * x[lag][0];162 accu_im -= (uint64_t)x[ 0][1] * x[lag][0];
163 163
164 phi[2-lag][1][0] = autocorr_calc(accu_re);164 phi[2-lag][1][0] = autocorr_calc(accu_re);
165 phi[2-lag][1][1] = autocorr_calc(accu_im);165 phi[2-lag][1][1] = autocorr_calc(accu_im);
@@ -167,28 +167,28 @@ static av_always_inline void autocorrelate(const int x[40][2], SoftFloat phi[3][ · 1 unmodified line
167 if (lag == 1) {167 if (lag == 1) {
168 accu_re = real_sum;168 accu_re = real_sum;
169 accu_im = imag_sum;169 accu_im = imag_sum;
170 accu_re += (int64_t)x[38][0] * x[39][0];170 accu_re += (uint64_t)x[38][0] * x[39][0];
171 accu_re += (int64_t)x[38][1] * x[39][1];171 accu_re += (uint64_t)x[38][1] * x[39][1];
172 accu_im += (int64_t)x[38][0] * x[39][1];172 accu_im += (uint64_t)x[38][0] * x[39][1];
173 accu_im -= (int64_t)x[38][1] * x[39][0];173 accu_im -= (uint64_t)x[38][1] * x[39][0];
174 174
175 phi[0][0][0] = autocorr_calc(accu_re);175 phi[0][0][0] = autocorr_calc(accu_re);
176 phi[0][0][1] = autocorr_calc(accu_im);176 phi[0][0][1] = autocorr_calc(accu_im);
177 }177 }
178 } else {178 } else {
179 for (i = 1; i < 38; i++) {179 for (i = 1; i < 38; i++) {
180 accu_re += (int64_t)x[i][0] * x[i][0];180 accu_re += (uint64_t)x[i][0] * x[i][0];
181 accu_re += (int64_t)x[i][1] * x[i][1];181 accu_re += (uint64_t)x[i][1] * x[i][1];
182 }182 }
183 real_sum = accu_re;183 real_sum = accu_re;
184 accu_re += (int64_t)x[ 0][0] * x[ 0][0];184 accu_re += (uint64_t)x[ 0][0] * x[ 0][0];
185 accu_re += (int64_t)x[ 0][1] * x[ 0][1];185 accu_re += (uint64_t)x[ 0][1] * x[ 0][1];
186 186
187 phi[2][1][0] = autocorr_calc(accu_re);187 phi[2][1][0] = autocorr_calc(accu_re);
188 188
189 accu_re = real_sum;189 accu_re = real_sum;
190 accu_re += (int64_t)x[38][0] * x[38][0];190 accu_re += (uint64_t)x[38][0] * x[38][0];
191 accu_re += (int64_t)x[38][1] * x[38][1];191 accu_re += (uint64_t)x[38][1] * x[38][1];
192 192
193 phi[1][0][0] = autocorr_calc(accu_re);193 phi[1][0][0] = autocorr_calc(accu_re);
194 }194 }

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t