eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-06-16 04:32:47 +02:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/vc2enc_dwt: avoid signed overflow in the 9/7 DWT lifting

Browse Source 
Fixes: 490488944/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC2_fuzzer-5310290362433536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f91556215)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-05-30 22:37:49 +02:00
parent cb55da3768
commit 31be6491d2
1 changed files with 16 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libavcodec/vc2enc_dwt.c
+16 -16
View File
@@ -56,7 +56,7 @@ static void vc2_subband_dwt_97(VC2TransformContext *t, dwtcoef *data,
ptrdiff_t stride, int width, int height)
{
int x, y;
dwtcoef *datal = data, *synth = t->buffer, *synthl = synth;
uint32_t *datal = (uint32_t *)data, *synth = (uint32_t *)t->buffer, *synthl = synth;
const ptrdiff_t synth_width = width << 1;
const ptrdiff_t synth_height = height << 1;
@@ -75,21 +75,21 @@ static void vc2_subband_dwt_97(VC2TransformContext *t, dwtcoef *data,
synthl = synth;
for (y = 0; y < synth_height; y++) {
/* Lifting stage 2. */
synthl[1] -= (8*synthl[0] + 9*synthl[2] - synthl[4] + 8) >> 4;
synthl[1] -= (dwtcoef)(8*synthl[0] + 9*synthl[2] - synthl[4] + 8) >> 4;
for (x = 1; x < width - 2; x++)
synthl[2*x + 1] -= (9*synthl[2*x] + 9*synthl[2*x + 2] - synthl[2*x + 4] -
synthl[2*x + 1] -= (dwtcoef)(9*synthl[2*x] + 9*synthl[2*x + 2] - synthl[2*x + 4] -
synthl[2 * x - 2] + 8) >> 4;
synthl[synth_width - 1] -= (17*synthl[synth_width - 2] -
synthl[synth_width - 1] -= (dwtcoef)(17*synthl[synth_width - 2] -
synthl[synth_width - 4] + 8) >> 4;
synthl[synth_width - 3] -= (8*synthl[synth_width - 2] +
synthl[synth_width - 3] -= (dwtcoef)(8*synthl[synth_width - 2] +
9*synthl[synth_width - 4] -
synthl[synth_width - 6] + 8) >> 4;
/* Lifting stage 1. */
synthl[0] += (synthl[1] + synthl[1] + 2) >> 2;
synthl[0] += (dwtcoef)(synthl[1] + synthl[1] + 2) >> 2;
for (x = 1; x < width - 1; x++)
synthl[2*x] += (synthl[2*x - 1] + synthl[2*x + 1] + 2) >> 2;
synthl[2*x] += (dwtcoef)(synthl[2*x - 1] + synthl[2*x + 1] + 2) >> 2;
synthl[synth_width - 2] += (synthl[synth_width - 3] +
synthl[synth_width - 2] += (dwtcoef)(synthl[synth_width - 3] +
synthl[synth_width - 1] + 2) >> 2;
synthl += synth_width;
}
@@ -97,13 +97,13 @@ static void vc2_subband_dwt_97(VC2TransformContext *t, dwtcoef *data,
/* Vertical synthesis: Lifting stage 2. */
synthl = synth + synth_width;
for (x = 0; x < synth_width; x++)
synthl[x] -= (8*synthl[x - synth_width] + 9*synthl[x + synth_width] -
synthl[x] -= (dwtcoef)(8*synthl[x - synth_width] + 9*synthl[x + synth_width] -
synthl[x + 3 * synth_width] + 8) >> 4;
synthl = synth + (synth_width << 1);
for (y = 1; y < height - 2; y++) {
for (x = 0; x < synth_width; x++)
synthl[x + synth_width] -= (9*synthl[x] +
synthl[x + synth_width] -= (dwtcoef)(9*synthl[x] +
9*synthl[x + 2 * synth_width] -
synthl[x - 2 * synth_width] -
synthl[x + 4 * synth_width] + 8) >> 4;
@@ -112,29 +112,29 @@ static void vc2_subband_dwt_97(VC2TransformContext *t, dwtcoef *data,
synthl = synth + (synth_height - 1) * synth_width;
for (x = 0; x < synth_width; x++) {
synthl[x] -= (17*synthl[x - synth_width] -
synthl[x] -= (dwtcoef)(17*synthl[x - synth_width] -
synthl[x - 3*synth_width] + 8) >> 4;
synthl[x - 2*synth_width] -= (9*synthl[x - 3*synth_width] +
synthl[x - 2*synth_width] -= (dwtcoef)(9*synthl[x - 3*synth_width] +
8*synthl[x - 1*synth_width] - synthl[x - 5*synth_width] + 8) >> 4;
}
/* Vertical synthesis: Lifting stage 1. */
synthl = synth;
for (x = 0; x < synth_width; x++)
synthl[x] += (synthl[x + synth_width] + synthl[x + synth_width] + 2) >> 2;
synthl[x] += (dwtcoef)(synthl[x + synth_width] + synthl[x + synth_width] + 2) >> 2;
synthl = synth + (synth_width << 1);
for (y = 1; y < height - 1; y++) {
for (x = 0; x < synth_width; x++)
synthl[x] += (synthl[x - synth_width] + synthl[x + synth_width] + 2) >> 2;
synthl[x] += (dwtcoef)(synthl[x - synth_width] + synthl[x + synth_width] + 2) >> 2;
synthl += synth_width << 1;
}
synthl = synth + (synth_height - 2) * synth_width;
for (x = 0; x < synth_width; x++)
synthl[x] += (synthl[x - synth_width] + synthl[x + synth_width] + 2) >> 2;
synthl[x] += (dwtcoef)(synthl[x - synth_width] + synthl[x + synth_width] + 2) >> 2;
deinterleave(data, stride, width, height, synth);
deinterleave(data, stride, width, height, (dwtcoef *)synth);
}
static void vc2_subband_dwt_53(VC2TransformContext *t, dwtcoef *data,