Fixes: signed integer overflow: 1795032576 + 598344192 cannot be represented in type 'int'
Fixes: 16196/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5636723419119616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cc78783ce5e8837d4f4ca43eedf2d299651e65ff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
... | ... |
@@ -619,7 +619,7 @@ static inline void tm2_null_res_block(TM2Context *ctx, AVFrame *pic, int bx, int |
619 | 619 |
ct = ctx->D[0] + ctx->D[1] + ctx->D[2] + ctx->D[3]; |
620 | 620 |
|
621 | 621 |
if (bx > 0) |
622 |
- left = last[-1] - ct; |
|
622 |
+ left = last[-1] - (unsigned)ct; |
|
623 | 623 |
else |
624 | 624 |
left = 0; |
625 | 625 |
|
... | ... |
@@ -630,7 +630,7 @@ static inline void tm2_null_res_block(TM2Context *ctx, AVFrame *pic, int bx, int |
630 | 630 |
last[2] = right - (diff >> 2); |
631 | 631 |
last[3] = right; |
632 | 632 |
{ |
633 |
- int tp = left; |
|
633 |
+ unsigned tp = left; |
|
634 | 634 |
|
635 | 635 |
ctx->D[0] = (tp + (ct >> 2)) - left; |
636 | 636 |
left += ctx->D[0]; |