summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndreas Rheinhardt <andreas.rheinhardt@gmail.com>2019-09-15 22:01:20 +0200
committerAndreas Rheinhardt <andreas.rheinhardt@gmail.com>2020-07-02 10:48:28 +0200
commit1fde9bf0a00790bd2163bf92f51c6bc2c05375c1 (patch)
treea3862be94b8fde8d0848d23d444fcf183815774b
parent9d67954134deb5ca56c19abf07a3afc2a544d0b5 (diff)
downloadffmpeg-1fde9bf0a00790bd2163bf92f51c6bc2c05375c1.tar.gz
avcodec/ttaenc: Fix undefined shift
ttaenc contained (1 << unary) - 1 as an argument for a function expecting an unsigned int. unary can be as big as 31 in this case. The type of the shift and the whole expression is int, because 1 fits into an integer, so that the behaviour is undefined if unary == 31 as the result of the shift can't be represented in an int §. Subtraction by 1 (which makes the result of the whole expression representable in an int) doesn't change that this is undefined (it usually leads to signed integer overflow which is undefined, too). The solution is simple: Make 1 unsigned to change the type of the whole expression to unsigned int (as the function expects anyway). Fixes ticket #8153. §: This of course presupposes the common int range of -2^31..2^31-1 Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 3ab488a5407f833ecc66e8fa4c537dc4852db720) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-rw-r--r--libavcodec/ttaenc.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/ttaenc.c b/libavcodec/ttaenc.c
index 3cc54d78c5..08a0d0483a 100644
--- a/libavcodec/ttaenc.c
+++ b/libavcodec/ttaenc.c
@@ -164,7 +164,7 @@ pkt_alloc:
put_bits(&pb, 31, 0x7FFFFFFF);
unary -= 31;
} else {
- put_bits(&pb, unary, (1 << unary) - 1);
+ put_bits(&pb, unary, (1U << unary) - 1);
unary = 0;
}
} while (unary);