Commit 17c71e3772 for ffmpeg
commit 17c71e3772d23dc797a230a3ce360c137ddad0a3
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat Oct 10 18:05:42 2026 +0200
avcodec/elbg: keep the total error in 64 bits
Signed integer overflow Replicated through Modified FFmpeg (fuzzer harness built with --disable-asm) with UBSAN
Fixes: signed integer overflow: 2147483647 - -106589 cannot be represented in type 'int'
Fixes: 472729757/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CINEPAK_fuzzer-5712538546536448
Fixes: fwDAxlQNlnpn
Regression since: ddc176d0eed7bd140c134c2b0923b575b13570c0
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
diff --git a/libavcodec/elbg.c b/libavcodec/elbg.c
index 84043af4fd..34d03d416e 100644
--- a/libavcodec/elbg.c
+++ b/libavcodec/elbg.c
@@ -45,7 +45,7 @@ typedef struct cell_s {
* ELBG internal data
*/
typedef struct ELBGContext {
- int error;
+ int64_t error;
int dim;
int num_cb;
int *codebook;
@@ -368,9 +368,9 @@ static void do_elbg(ELBGContext *restrict elbg, int *points, int numpoints,
int *const size_part = elbg->size_part;
int i, j, steps = 0;
int best_idx = 0;
- int last_error;
+ int64_t last_error;
- elbg->error = INT_MAX;
+ elbg->error = INT64_MAX;
elbg->points = points;
do {
@@ -398,7 +398,7 @@ static void do_elbg(ELBGContext *restrict elbg, int *points, int numpoints,
}
}
elbg->nearest_cb[i] = best_idx;
- elbg->error = (elbg->error >= INT_MAX - best_dist) ? INT_MAX : elbg->error + best_dist;
+ elbg->error += best_dist;
elbg->utility[elbg->nearest_cb[i]] = (elbg->utility[elbg->nearest_cb[i]] >= INT_MAX - best_dist) ?
INT_MAX : elbg->utility[elbg->nearest_cb[i]] + best_dist;
free_cells->index = i;