This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch master
in repository ffmpeg.

commit de1bc8ea1dcebd00321ad6476db101871022fc2c
Author:     Andreas Rheinhardt <[email protected]>
AuthorDate: Fri Aug 7 01:30:56 2026 +0200
Commit:     Andreas Rheinhardt <[email protected]>
CommitDate: Sun Aug 9 17:22:53 2026 +0200

    avcodec/ttaencdsp: Use unsigned to avoid UB
    
    The decoder has been made to use unsigned values after
    the fuzzer encountered signed integer overflow;
    the same can probably happen in the encoder (I don't know),
    but it definitely can happen in the checkasm test that
    will be added soon. So use unsigned here, too.
    
    Reviewed-by: Lynne <[email protected]>
    Signed-off-by: Andreas Rheinhardt <[email protected]>
---
 libavcodec/ttaencdsp.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/libavcodec/ttaencdsp.c b/libavcodec/ttaencdsp.c
index 0a717313bf..7e4fed0679 100644
--- a/libavcodec/ttaencdsp.c
+++ b/libavcodec/ttaencdsp.c
@@ -20,9 +20,12 @@
 #include "ttaencdsp.h"
 #include "config.h"
 
-static void ttaenc_filter_process_c(int32_t *qm, int32_t *dx, int32_t *dl,
+static void ttaenc_filter_process_c(int32_t *qmi, int32_t *dx, int32_t *dl,
                                     int32_t *error, int32_t *in, int32_t shift,
-                                    int32_t round) {
+                                    int32_t round)
+{
+    uint32_t *qm = qmi;
+
     if (*error < 0) {
         qm[0] -= dx[0]; qm[1] -= dx[1]; qm[2] -= dx[2]; qm[3] -= dx[3];
         qm[4] -= dx[4]; qm[5] -= dx[5]; qm[6] -= dx[6]; qm[7] -= dx[7];
@@ -42,9 +45,9 @@ static void ttaenc_filter_process_c(int32_t *qm, int32_t *dx, 
int32_t *dl,
     dx[6] = ((dl[6] >> 30) | 2) & ~1;
     dx[7] = ((dl[7] >> 30) | 4) & ~3;
 
-    dl[4] = -dl[5]; dl[5] = -dl[6];
-    dl[6] = *in - dl[7]; dl[7] = *in;
-    dl[5] += dl[6]; dl[4] += dl[5];
+    dl[4]  = -(unsigned)dl[5];     dl[5] = -(unsigned)dl[6];
+    dl[6]  = *in -(unsigned)dl[7]; dl[7] = *in;
+    dl[5] += (unsigned)dl[6];      dl[4] += (unsigned)dl[5];
 
     *in -= (round >> shift);
     *error = *in;

_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to