avcodec/h264_mvpred: Fix multiple runtime error: left shift of negative value
authorMichael Niedermayer <michael@niedermayer.cc>
Fri, 3 Mar 2017 03:39:06 +0000 (04:39 +0100)
committerMichael Niedermayer <michael@niedermayer.cc>
Sat, 4 Mar 2017 16:48:04 +0000 (17:48 +0100)
Fixes: 710/clusterfuzz-testcase-5091051431788544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/h264_mvpred.h

index 24f250d..339cf62 100644 (file)
@@ -248,7 +248,7 @@ static av_always_inline void pred_8x16_motion(const H264Context *const h,
             if (IS_INTERLACED(type)) {          \
                 refn >>= 1;                     \
                 AV_COPY32(mvbuf[idx], mvn);     \
-                mvbuf[idx][1] <<= 1;            \
+                mvbuf[idx][1] *= 2;             \
                 mvn = mvbuf[idx];               \
             }                                   \
         }                                       \