commit 0f511b4518fa4337f603275f865eb13ac5520d0f
author Michael Niedermayer <michael@niedermayer.cc> Sun Dec 01 02:31:56 2024
committer Michael Niedermayer <michael@niedermayer.cc> Wed Jan 08 22:23:25 2025
tree 4f603afc255136866e9fe2045824eca14d3fc7f8
parent 56faee21c136942c491f30a2e82cfbbfce180beb

avcodec/osq: Fixes several undefined overflows in do_decode()

Fixes: signed integer overflow: 1239596184 + 2119376059 cannot be represented in type 'int'
Fixes: 376136844/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6581164455821312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

libavcodec/osq.c

diff --git a/libavcodec/osq.c b/libavcodec/osq.c
index 1bf6264..83b4a9d 100644
--- a/libavcodec/osq.c
+++ b/libavcodec/osq.c
@@ -300,7 +300,7 @@
                 dst[n] += (int)(P2 + P3) / 2 + (unsigned)p;
                 break;
             case 8:
-                dst[n] += (int)(P2 + P3) / 2;
+                dst[n] += (int)(P2 + P3) / 2 + 0U;
                 break;
             case 9:
                 dst[n] += (int)(P2 * 2 + P3) / 3 + (unsigned)p;
@@ -309,13 +309,13 @@
                 dst[n] += (int)(P2 + P3 * 2) / 3 + (unsigned)p;
                 break;
             case 11:
-                dst[n] += (int)((unsigned)dst[A] + dst[B]) / 2;
+                dst[n] += (int)((unsigned)dst[A] + dst[B]) / 2 + 0U;
                 break;
             case 12:
                 dst[n] += (unsigned)dst[B];
                 break;
             case 13:
-                dst[n] += (int)(unsigned)(dst[D] + dst[B]) / 2;
+                dst[n] += (int)((unsigned)dst[D] + dst[B]) / 2 + 0U;
                 break;
             case 14:
                 dst[n] += (int)((unsigned)P2 + dst[A]) / 2 + (unsigned)p;