LAV
/
FFmpeg
1
0
Fork 0
Code

avcodec/eac3dec: avoid float noise in fixed mode addition to overflow 

Fixes: 2.28595e+09 is outside the range of representable values of type 'int'
Fixes: 54644/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AC3_FIXED_fuzzer-4816961584627712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2023-01-06 23:36:12 +01:00
parent 9ea6d93218
commit 2f48d227c1
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
2 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/ac3.h
View File

@ -53,6 +53,7 @@
#define AC3_DYNAMIC_RANGE1 0 #define AC3_DYNAMIC_RANGE1 0
typedef int INTFLOAT; typedef int INTFLOAT;
typedef unsigned int UINTFLOAT;
typedef int16_t SHORTFLOAT; typedef int16_t SHORTFLOAT;
#else /* USE_FIXED */ #else /* USE_FIXED */
@ -73,6 +74,7 @@ typedef int16_t SHORTFLOAT;
#define AC3_DYNAMIC_RANGE1 1.0f #define AC3_DYNAMIC_RANGE1 1.0f
typedef float INTFLOAT; typedef float INTFLOAT;
typedef float UINTFLOAT;
typedef float SHORTFLOAT; typedef float SHORTFLOAT;
#endif /* USE_FIXED */ #endif /* USE_FIXED */

4
libavcodec/eac3dec.c
View File

@ -138,9 +138,11 @@ static void ff_eac3_apply_spectral_extension(AC3DecodeContext *s)
// spx_noise_blend and spx_signal_blend are both FP.23 // spx_noise_blend and spx_signal_blend are both FP.23
nscale *= 1.0 / (1<<23); nscale *= 1.0 / (1<<23);
sscale *= 1.0 / (1<<23); sscale *= 1.0 / (1<<23);
if (nscale < -1.0)
nscale = -1.0;
#endif #endif
for (i = 0; i < s->spx_band_sizes[bnd]; i++) { for (i = 0; i < s->spx_band_sizes[bnd]; i++) {
float noise = nscale * (int32_t)av_lfg_get(&s->dith_state); UINTFLOAT noise = (INTFLOAT)(nscale * (int32_t)av_lfg_get(&s->dith_state));
s->transform_coeffs[ch][bin] *= sscale; s->transform_coeffs[ch][bin] *= sscale;
s->transform_coeffs[ch][bin++] += noise; s->transform_coeffs[ch][bin++] += noise;
} }