Commit 6608339778 for ffmpeg
commit 660833977850014e767c0a15d1da3f1b9ea86f4c
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat Oct 10 05:09:49 2026 +0200
avcodec/adpcm: compute the Rhetorex step index update in 32-bit wrapping arithmetic
Signed integer overflow Replicated through API with UBSAN
Fixes: signed integer overflow: 1962519552 + 223346688 cannot be represented in type 'int'
Fixes: 570730457/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_RHETOREX_DEC_fuzzer-5448669789487104
Fixes: zBNgmUo4QhnW
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c
index df25b665a4..3c294d9120 100644
--- a/libavcodec/adpcm.c
+++ b/libavcodec/adpcm.c
@@ -778,7 +778,7 @@ static inline int16_t adpcm_rhetorex_expand_nibble(ADPCMChannelStatus *c, uint16
c->sample2 = c->sample1;
c->sample1 = sample;
- c->step_index = FFABS(64512 * c->step_index + 65536 * rhetorex_index[delta]) >> 16;
+ c->step_index = FFABS((int)(64512U * c->step_index + 65536U * rhetorex_index[delta])) >> 16;
return sample;
}