Skip to content

Commit 2b08646

Browse files
committed
Avoid reading out of bounds due to negative aaIccIndexMapped
Fixes: 3452/clusterfuzz-testcase-4898065225875456 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
1 parent 7c22a0f commit 2b08646

File tree

1 file changed

+6
-3
lines changed

1 file changed

+6
-3
lines changed

libSBRdec/src/psdec.cpp

+6-3
Original file line numberDiff line numberDiff line change
@@ -944,7 +944,7 @@ void initSlotBasedRotation( HANDLE_PS_DEC h_ps_d, /*!< pointer to the module sta
944944

945945
FIXP_SGL invL;
946946
FIXP_DBL ScaleL, ScaleR;
947-
FIXP_DBL Alpha, Beta;
947+
FIXP_DBL Alpha, Beta, AlphasValue;
948948
FIXP_DBL h11r, h12r, h21r, h22r;
949949

950950
const FIXP_DBL *PScaleFactors;
@@ -1015,8 +1015,11 @@ void initSlotBasedRotation( HANDLE_PS_DEC h_ps_d, /*!< pointer to the module sta
10151015
ScaleR = PScaleFactors[noIidSteps + h_ps_d->specificTo.mpeg.coef.aaIidIndexMapped[env][bin]];
10161016
ScaleL = PScaleFactors[noIidSteps - h_ps_d->specificTo.mpeg.coef.aaIidIndexMapped[env][bin]];
10171017

1018-
Beta = fMult (fMult( Alphas[h_ps_d->specificTo.mpeg.coef.aaIccIndexMapped[env][bin]], ( ScaleR - ScaleL )), FIXP_SQRT05);
1019-
Alpha = Alphas[h_ps_d->specificTo.mpeg.coef.aaIccIndexMapped[env][bin]]>>1;
1018+
AlphasValue = 0;
1019+
if (h_ps_d->specificTo.mpeg.coef.aaIccIndexMapped[env][bin] >= 0)
1020+
AlphasValue = Alphas[h_ps_d->specificTo.mpeg.coef.aaIccIndexMapped[env][bin]];
1021+
Beta = fMult (fMult( AlphasValue, ( ScaleR - ScaleL )), FIXP_SQRT05);
1022+
Alpha = AlphasValue>>1;
10201023

10211024
/* Alpha and Beta are now both scaled by 2 shifts right */
10221025

0 commit comments

Comments
 (0)