diff options
author | Michael Niedermayer <michael@niedermayer.cc> | 2019-09-27 19:36:16 +0300 |
---|---|---|
committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-09-30 23:44:43 +0300 |
commit | 675f62a202be7cfe9576b48679b8e6bc1183e84e (patch) | |
tree | 1364865e64f6d516da6ce1988418860831c1b9e0 /libavcodec/aptx.c | |
parent | 056bc9393ea78d24982cdf555c0bb3fcfe734262 (diff) |
avcodec/aptx: Fix multiple shift anomalies
Fixes: left shift of negative value -24576
Fixes: 17719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APTX_fuzzer-5710508002377728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/aptx.c')
-rw-r--r-- | libavcodec/aptx.c | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/libavcodec/aptx.c b/libavcodec/aptx.c index 8750d8421f..e3fb064a6d 100644 --- a/libavcodec/aptx.c +++ b/libavcodec/aptx.c @@ -480,7 +480,7 @@ static void aptx_update_codeword_history(Channel *channel) int32_t cw = ((channel->quantize[0].quantized_sample & 3) << 0) + ((channel->quantize[1].quantized_sample & 2) << 1) + ((channel->quantize[2].quantized_sample & 1) << 3); - channel->codeword_history = (cw << 8) + (channel->codeword_history << 4); + channel->codeword_history = (cw << 8) + ((unsigned)channel->codeword_history << 4); } static void aptx_generate_dither(Channel *channel) @@ -492,9 +492,9 @@ static void aptx_generate_dither(Channel *channel) aptx_update_codeword_history(channel); m = (int64_t)5184443 * (channel->codeword_history >> 7); - d = (m << 2) + (m >> 22); + d = (m * 4) + (m >> 22); for (subband = 0; subband < NB_SUBBANDS; subband++) - channel->dither[subband] = d << (23 - 5*subband); + channel->dither[subband] = (unsigned)d << (23 - 5*subband); channel->dither_parity = (d >> 25) & 1; } @@ -759,12 +759,12 @@ static void aptx_invert_quantization(InvertQuantize *invert_quantize, if (quantized_sample < 0) qr = -qr; - qr = rshift64_clip24(((int64_t)qr<<32) + MUL64(dither, tables->invert_quantize_dither_factors[idx]), 32); + qr = rshift64_clip24((qr * (1LL<<32)) + MUL64(dither, tables->invert_quantize_dither_factors[idx]), 32); invert_quantize->reconstructed_difference = MUL64(invert_quantize->quantization_factor, qr) >> 19; /* update factor_select */ factor_select = 32620 * invert_quantize->factor_select; - factor_select = rshift32(factor_select + (tables->quantize_factor_select_offset[idx] << 15), 15); + factor_select = rshift32(factor_select + (tables->quantize_factor_select_offset[idx] * (1 << 15)), 15); invert_quantize->factor_select = av_clip(factor_select, 0, tables->factor_max); /* update quantization factor */ @@ -801,7 +801,7 @@ static void aptx_prediction_filtering(Prediction *prediction, prediction->previous_reconstructed_sample = reconstructed_sample; reconstructed_differences = aptx_reconstructed_differences_update(prediction, reconstructed_difference, order); - srd0 = FFDIFFSIGN(reconstructed_difference, 0) << 23; + srd0 = FFDIFFSIGN(reconstructed_difference, 0) * (1 << 23); for (i = 0; i < order; i++) { int32_t srd = FF_SIGNBIT(reconstructed_differences[-i-1]) | 1; prediction->d_weight[i] -= rshift32(prediction->d_weight[i] - srd*srd0, 8); @@ -830,7 +830,7 @@ static void aptx_process_subband(InvertQuantize *invert_quantize, range = 0x100000; sw1 = rshift32(-same_sign[1] * prediction->s_weight[1], 1); - sw1 = (av_clip(sw1, -range, range) & ~0xF) << 4; + sw1 = (av_clip(sw1, -range, range) & ~0xF) * 16; range = 0x300000; weight[0] = 254 * prediction->s_weight[0] + 0x800000*same_sign[0] + sw1; @@ -1044,7 +1044,7 @@ static int aptx_decode_frame(AVCodecContext *avctx, void *data, for (channel = 0; channel < NB_CHANNELS; channel++) for (sample = 0; sample < 4; sample++) AV_WN32A(&frame->data[channel][4*(opos+sample)], - samples[channel][sample] << 8); + samples[channel][sample] * 256); } *got_frame_ptr = 1; |