eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-06-16 04:32:47 +02:00
Code Issues Packages Projects Releases Wiki Activity

swscale/output: fix integer overflows in chroma in yuv2rgba64_X_c_template()

Browse Source 
Fixes: signed integer overflow: 130489 * 16525 cannot be represented in type 'int'
Fixes: 488950053/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-4627272670969856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3b98e29da8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-03-05 17:18:18 +01:00
parent d1e401f31b
commit ab0702cbf3
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libswscale/output.c
+4 -4
View File
@@ -1007,8 +1007,8 @@ yuv2rgba64_X_c_template(SwsContext *c, const int16_t *lumFilter,
int j;
unsigned Y1 = -0x40000000;
unsigned Y2 = -0x40000000;
int U = -(128 << 23); // 19
int V = -(128 << 23);
unsigned U = -(128 << 23); // 19
unsigned V = -(128 << 23);
int R, G, B;
for (j = 0; j < lumFilterSize; j++) {
@@ -1038,8 +1038,8 @@ yuv2rgba64_X_c_template(SwsContext *c, const int16_t *lumFilter,
Y1 += 0x10000;
Y2 = (int)Y2 >> 14;
Y2 += 0x10000;
U >>= 14;
V >>= 14;
U = (int)U >> 14;
V = (int)V >> 14;
// 8 bits: 27 -> 17 bits, 16 bits: 31 - 14 = 17 bits
Y1 -= c->yuv2rgb_y_offset;