github-mirrors/FFmpeg
1
0
Fork 0
mirror of https://mirror.skon.top/https://github.com/FFmpeg/FFmpeg synced 2026-04-20 21:00:41 +08:00
Code Issues Packages Projects Releases Wiki Activity

swresample/resample_template: add casts to avoid undefined overflows

Browse Source 
resample_linear can produce overflows with craftet input,
The added casts should have no effect on the binary output or the operations they
just change things to a defined regime

Fixes: signed integer overflow: 2069416960 + 78151680 cannot be represented in type 'int'
Fixes: 472047214/clusterfuzz-testcase-minimized-ffmpeg_SWR_fuzzer-6374046976770048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-02-15 02:18:01 +01:00
parent 30a6b78bd4
commit 17cad7ac75
1 changed files with 12 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
libswresample/resample_template.c
View File

@@ -25,6 +25,8 @@
* @author Michael Niedermayer <michaelni@gmx.at>
*/
// FELEM2U, a variant of FELEM2 which does not produce undefined overflow
#if defined(TEMPLATE_RESAMPLE_DBL)
# define RENAME(N) N ## _double
@@ -32,6 +34,7 @@
# define DELEM double
# define FELEM double
# define FELEM2 double
# define FELEM2U double
# define FOFFSET 0
# define OUT(d, v) d = v
@@ -42,6 +45,7 @@
# define DELEM float
# define FELEM float
# define FELEM2 float
# define FELEM2U float
# define FOFFSET 0
# define OUT(d, v) d = v
@@ -52,6 +56,7 @@
# define DELEM int32_t
# define FELEM int32_t
# define FELEM2 int64_t
# define FELEM2U uint64_t
# define FELEM_MAX INT32_MAX
# define FELEM_MIN INT32_MIN
# define FOFFSET (1<<(FILTER_SHIFT-1))
@@ -64,6 +69,7 @@
# define DELEM int16_t
# define FELEM int16_t
# define FELEM2 int32_t
# define FELEM2U uint32_t
# define FELEML int64_t
# define FELEM_MAX INT16_MAX
# define FELEM_MIN INT16_MIN
@@ -161,7 +167,7 @@ static int RENAME(resample_linear)(ResampleContext *c,
for (dst_index = 0; dst_index < n; dst_index++) {
FELEM *filter = ((FELEM *) c->filter_bank) + c->filter_alloc * index;
FELEM2 val = FOFFSET, v2 = FOFFSET;
FELEM2U val = FOFFSET, v2 = FOFFSET;
int i;
for (i = 0; i < c->filter_length; i++) {
@@ -169,15 +175,15 @@ static int RENAME(resample_linear)(ResampleContext *c,
v2 += src[sample_index + i] * (FELEM2)filter[i + c->filter_alloc];
}
#ifdef FELEML
val += (v2 - val) * (FELEML) frac / c->src_incr;
val += (FELEM2)(v2 - val) * (FELEML) frac / c->src_incr;
#else
# if FILTER_SHIFT == 0
val += (v2 - val) * inv_src_incr * frac;
val += (FELEM2)(v2 - val) * inv_src_incr * frac;
# else
val += (v2 - val) / c->src_incr * frac;
val += (FELEM2)(v2 - val) / c->src_incr * frac;
# endif
#endif
OUT(dst[dst_index], val);
OUT(dst[dst_index], (FELEM2)val);
frac += c->dst_incr_mod;
index += c->dst_incr_div;
@@ -205,6 +211,7 @@ static int RENAME(resample_linear)(ResampleContext *c,
#undef DELEM
#undef FELEM
#undef FELEM2
#undef FELEM2U
#undef FELEML
#undef FELEM_MAX
#undef FELEM_MIN