mirrors/flac
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

libFLAC/lpc.c: Fix signed integer overflow

Browse Source 
Do the addition as 64 bits before truncating to 32 bits.

Credit: Oss-Fuzz
Issue: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16459
Testcase: fuzzer_decoder-5728784602365952
This commit is contained in:
Erik de Castro Lopo 2019-08-25 17:59:02 +10:00
parent 8147ee7ea2
commit 5598543a96
1 changed files with 12 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
src/libFLAC/lpc.c
View File

@ -1104,7 +1104,7 @@ void FLAC__lpc_restore_signal_wide(const FLAC__int32 * flac_restrict residual, u
sum += qlp_coeff[2] * (FLAC__int64)data[i-3];
sum += qlp_coeff[1] * (FLAC__int64)data[i-2];
sum += qlp_coeff[0] * (FLAC__int64)data[i-1];
data[i] = residual[i] + (FLAC__int32)(sum >> lp_quantization);
data[i] = (FLAC__int32) (residual[i] + (sum >> lp_quantization));
}
}
else { /* order == 11 */
@ -1121,7 +1121,7 @@ void FLAC__lpc_restore_signal_wide(const FLAC__int32 * flac_restrict residual, u
sum += qlp_coeff[2] * (FLAC__int64)data[i-3];
sum += qlp_coeff[1] * (FLAC__int64)data[i-2];
sum += qlp_coeff[0] * (FLAC__int64)data[i-1];
data[i] = residual[i] + (FLAC__int32)(sum >> lp_quantization);
data[i] = (FLAC__int32) (residual[i] + (sum >> lp_quantization));
}
}
}
@ -1139,7 +1139,7 @@ void FLAC__lpc_restore_signal_wide(const FLAC__int32 * flac_restrict residual, u
sum += qlp_coeff[2] * (FLAC__int64)data[i-3];
sum += qlp_coeff[1] * (FLAC__int64)data[i-2];
sum += qlp_coeff[0] * (FLAC__int64)data[i-1];
data[i] = residual[i] + (FLAC__int32)(sum >> lp_quantization);
data[i] = (FLAC__int32) (residual[i] + (sum >> lp_quantization));
}
}
else { /* order == 9 */
@ -1154,7 +1154,7 @@ void FLAC__lpc_restore_signal_wide(const FLAC__int32 * flac_restrict residual, u
sum += qlp_coeff[2] * (FLAC__int64)data[i-3];
sum += qlp_coeff[1] * (FLAC__int64)data[i-2];
sum += qlp_coeff[0] * (FLAC__int64)data[i-1];
data[i] = residual[i] + (FLAC__int32)(sum >> lp_quantization);
data[i] = (FLAC__int32) (residual[i] + (sum >> lp_quantization));
}
}
}
@ -1172,7 +1172,7 @@ void FLAC__lpc_restore_signal_wide(const FLAC__int32 * flac_restrict residual, u
sum += qlp_coeff[2] * (FLAC__int64)data[i-3];
sum += qlp_coeff[1] * (FLAC__int64)data[i-2];
sum += qlp_coeff[0] * (FLAC__int64)data[i-1];
data[i] = residual[i] + (FLAC__int32)(sum >> lp_quantization);
data[i] = (FLAC__int32) (residual[i] + (sum >> lp_quantization));
}
}
else { /* order == 7 */
@ -1185,7 +1185,7 @@ void FLAC__lpc_restore_signal_wide(const FLAC__int32 * flac_restrict residual, u
sum += qlp_coeff[2] * (FLAC__int64)data[i-3];
sum += qlp_coeff[1] * (FLAC__int64)data[i-2];
sum += qlp_coeff[0] * (FLAC__int64)data[i-1];
data[i] = residual[i] + (FLAC__int32)(sum >> lp_quantization);
data[i] = (FLAC__int32) (residual[i] + (sum >> lp_quantization));
}
}
}
@ -1199,7 +1199,7 @@ void FLAC__lpc_restore_signal_wide(const FLAC__int32 * flac_restrict residual, u
sum += qlp_coeff[2] * (FLAC__int64)data[i-3];
sum += qlp_coeff[1] * (FLAC__int64)data[i-2];
sum += qlp_coeff[0] * (FLAC__int64)data[i-1];
data[i] = residual[i] + (FLAC__int32)(sum >> lp_quantization);
data[i] = (FLAC__int32) (residual[i] + (sum >> lp_quantization));
}
}
else { /* order == 5 */
@ -1210,7 +1210,7 @@ void FLAC__lpc_restore_signal_wide(const FLAC__int32 * flac_restrict residual, u
sum += qlp_coeff[2] * (FLAC__int64)data[i-3];
sum += qlp_coeff[1] * (FLAC__int64)data[i-2];
sum += qlp_coeff[0] * (FLAC__int64)data[i-1];
data[i] = residual[i] + (FLAC__int32)(sum >> lp_quantization);
data[i] = (FLAC__int32) (residual[i] + (sum >> lp_quantization));
}
}
}
@ -1224,7 +1224,7 @@ void FLAC__lpc_restore_signal_wide(const FLAC__int32 * flac_restrict residual, u
sum += qlp_coeff[2] * (FLAC__int64)data[i-3];
sum += qlp_coeff[1] * (FLAC__int64)data[i-2];
sum += qlp_coeff[0] * (FLAC__int64)data[i-1];
data[i] = residual[i] + (FLAC__int32)(sum >> lp_quantization);
data[i] = (FLAC__int32) (residual[i] + (sum >> lp_quantization));
}
}
else { /* order == 3 */
@ -1233,7 +1233,7 @@ void FLAC__lpc_restore_signal_wide(const FLAC__int32 * flac_restrict residual, u
sum += qlp_coeff[2] * (FLAC__int64)data[i-3];
sum += qlp_coeff[1] * (FLAC__int64)data[i-2];
sum += qlp_coeff[0] * (FLAC__int64)data[i-1];
data[i] = residual[i] + (FLAC__int32)(sum >> lp_quantization);
data[i] = (FLAC__int32) (residual[i] + (sum >> lp_quantization));
}
}
}
@ -1243,7 +1243,7 @@ void FLAC__lpc_restore_signal_wide(const FLAC__int32 * flac_restrict residual, u
sum = 0;
sum += qlp_coeff[1] * (FLAC__int64)data[i-2];
sum += qlp_coeff[0] * (FLAC__int64)data[i-1];
data[i] = residual[i] + (FLAC__int32)(sum >> lp_quantization);
data[i] = (FLAC__int32) (residual[i] + (sum >> lp_quantization));
}
}
else { /* order == 1 */
@ -1290,7 +1290,7 @@ void FLAC__lpc_restore_signal_wide(const FLAC__int32 * flac_restrict residual, u
sum += qlp_coeff[ 1] * (FLAC__int64)data[i- 2];
sum += qlp_coeff[ 0] * (FLAC__int64)data[i- 1];
}
data[i] = residual[i] + (FLAC__int32)(sum >> lp_quantization);
data[i] = (FLAC__int32) (residual[i] + (sum >> lp_quantization));
}
}
}