diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-03-08 23:41:34 +0300 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-05-20 04:41:33 +0300 |
| commit | bf37f12f40d38437a428aee18a4f4302ad159637 (patch) | |
| tree | 86f19a048f30a78b337068349aaa8f4b54f0f774 /libavcodec/mjpegdec.c | |
| parent | 4d4ce42f0b864054b04c8b31df8b0a2e321498c0 (diff) | |
avcodec/mjpegdec: Fix runtime error: left shift of negative value -127
Fixes: 733/clusterfuzz-testcase-4682158096515072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 800d02abe041deacab5585bf41c1bc2ae5f4b922)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/mjpegdec.c')
| -rw-r--r-- | libavcodec/mjpegdec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index 826c037682..6f7c734642 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -1190,13 +1190,13 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor, PREDICT(pred, ptr[-linesize-1], ptr[-linesize], ptr[-1], predictor); pred &= mask; - *ptr = pred + (dc << point_transform); + *ptr = pred + ((unsigned)dc << point_transform); }else{ ptr16 = (uint16_t*)(s->picture_ptr->data[c] + 2*(linesize * (v * mb_y + y)) + 2*(h * mb_x + x)); //FIXME optimize this crap PREDICT(pred, ptr16[-linesize-1], ptr16[-linesize], ptr16[-1], predictor); pred &= mask; - *ptr16= pred + (dc << point_transform); + *ptr16= pred + ((unsigned)dc << point_transform); } if (++x == h) { |