summaryrefslogtreecommitdiff
path: root/libavcodec/aacdec_fixed.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2017-05-13 18:13:48 +0200
committerMichael Niedermayer <michael@niedermayer.cc>2017-05-13 18:14:18 +0200
commit26227d91865ddfbfe35c9ff84853cc469e1c7daf (patch)
tree06364dd27cefc5abfaacb41fc9aeefae352596ae /libavcodec/aacdec_fixed.c
parent87b08ee6d2a3b0880f0a267c5d51dc7f415e81d7 (diff)
downloadffmpeg-26227d91865ddfbfe35c9ff84853cc469e1c7daf.tar.gz
avcodec/aacdec_fixed: Fix runtime error: left shift of negative value -1
Fixes: 1535/clusterfuzz-testcase-minimized-5826695535788032 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/aacdec_fixed.c')
-rw-r--r--libavcodec/aacdec_fixed.c10
1 files changed, 5 insertions, 5 deletions
diff --git a/libavcodec/aacdec_fixed.c b/libavcodec/aacdec_fixed.c
index 9580370e7d..b416cf1d25 100644
--- a/libavcodec/aacdec_fixed.c
+++ b/libavcodec/aacdec_fixed.c
@@ -125,7 +125,7 @@ static inline int *DEC_SQUAD(int *dst, unsigned idx)
static inline int *DEC_UPAIR(int *dst, unsigned idx, unsigned sign)
{
dst[0] = (idx & 15) * (1 - (sign & 0xFFFFFFFE));
- dst[1] = (idx >> 4 & 15) * (1 - ((sign & 1) << 1));
+ dst[1] = (idx >> 4 & 15) * (1 - ((sign & 1) * 2));
return dst + 2;
}
@@ -134,16 +134,16 @@ static inline int *DEC_UQUAD(int *dst, unsigned idx, unsigned sign)
{
unsigned nz = idx >> 12;
- dst[0] = (idx & 3) * (1 + (((int)sign >> 31) << 1));
+ dst[0] = (idx & 3) * (1 + (((int)sign >> 31) * 2));
sign <<= nz & 1;
nz >>= 1;
- dst[1] = (idx >> 2 & 3) * (1 + (((int)sign >> 31) << 1));
+ dst[1] = (idx >> 2 & 3) * (1 + (((int)sign >> 31) * 2));
sign <<= nz & 1;
nz >>= 1;
- dst[2] = (idx >> 4 & 3) * (1 + (((int)sign >> 31) << 1));
+ dst[2] = (idx >> 4 & 3) * (1 + (((int)sign >> 31) * 2));
sign <<= nz & 1;
nz >>= 1;
- dst[3] = (idx >> 6 & 3) * (1 + (((int)sign >> 31) << 1));
+ dst[3] = (idx >> 6 & 3) * (1 + (((int)sign >> 31) * 2));
return dst + 4;
}