avcodec/takdec: Fix integer overflow in decode_subframe()
authorMichael Niedermayer <michael@niedermayer.cc>
Thu, 27 Jul 2017 21:49:26 +0000 (23:49 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Sat, 29 Jul 2017 12:18:36 +0000 (14:18 +0200)
commit406d9fdd135789fc97a40e1f316a6f9d7079a452
tree9a7cd3ca1b7a3fe125c350ce29236def80d0656e
parent8f9cbb3b7e844f80e07caac40ac14a64aa938c99
avcodec/takdec: Fix integer overflow in decode_subframe()

Fixes: runtime error: signed integer overflow: -536870912 - 1972191120 cannot be represented in type 'int'
Fixes: 2711/clusterfuzz-testcase-minimized-4975142398590976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2c630d159ffe8a9822e81f9c041652762b37e068)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/takdec.c