avcodec/takdec: Fix integer overflow in decode_subframe()
authorMichael Niedermayer <michael@niedermayer.cc>
Thu, 27 Jul 2017 21:49:26 +0000 (23:49 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Sat, 29 Jul 2017 12:18:35 +0000 (14:18 +0200)
commit6274709c1c110cbb714a2bd0292bb9e96d9d561f
treec2ddbe06fc15884a264622f539e6f9116260629f
parent06ce68d8a07d6365d67fdd8ed3c1e422f97a43fa
avcodec/takdec: Fix integer overflow in decode_subframe()

Fixes: runtime error: signed integer overflow: -536870912 - 1972191120 cannot be represented in type 'int'
Fixes: 2711/clusterfuzz-testcase-minimized-4975142398590976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2c630d159ffe8a9822e81f9c041652762b37e068)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/takdec.c