avcodec/mpeg12dec: Fix runtime error: left shift of negative value -2
authorMichael Niedermayer <michael@niedermayer.cc>
Sat, 25 Feb 2017 20:07:24 +0000 (21:07 +0100)
committerMichael Niedermayer <michael@niedermayer.cc>
Sun, 26 Feb 2017 16:16:22 +0000 (17:16 +0100)
671/clusterfuzz-testcase-4990381827555328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/mpeg12dec.c

index 5f86029..d44ddb2 100644 (file)
@@ -948,8 +948,8 @@ static int mpeg_decode_mb(MpegEncContext *s, int16_t block[12][64])
                         dmy = get_dmv(s);
 
 
-                        s->last_mv[i][0][1] = my << my_shift;
-                        s->last_mv[i][1][1] = my << my_shift;
+                        s->last_mv[i][0][1] = my * (1 << my_shift);
+                        s->last_mv[i][1][1] = my * (1 << my_shift);
 
                         s->mv[i][0][0] = mx;
                         s->mv[i][0][1] = my;