X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Flagarith.c;h=860381746d136912bbb996c02091c6330d953d86;hb=faa5a2181df53b5226f998a20b735798addcd365;hp=469eec42327c8fffc964b58f87a508f3e2375a07;hpb=ed1fe7b2feeb914750ffca2ed030738b3cdc4858;p=ffmpeg

diff --git a/libavcodec/lagarith.c b/libavcodec/lagarith.c
index 469eec42327..860381746d1 100644
--- a/libavcodec/lagarith.c
+++ b/libavcodec/lagarith.c
@@ -91,14 +91,14 @@ static uint32_t softfloat_mul(uint32_t x, uint64_t mantissa)
     uint64_t h = x * (mantissa >> 32);
     h += l >> 32;
     l &= 0xffffffff;
-    l += 1 << av_log2(h >> 21);
+    l += 1LL << av_log2(h >> 21);
     h += l >> 32;
     return h >> 20;
 }
 
 static uint8_t lag_calc_zero_run(int8_t x)
 {
-    return (x << 1) ^ (x >> 7);
+    return (x * 2) ^ (x >> 7);
 }
 
 static int lag_decode_prob(GetBitContext *gb, uint32_t *value)
@@ -191,7 +191,9 @@ static int lag_read_prob_header(lag_rac *rac, GetBitContext *gb)
         }
 
         scale_factor++;
-        cumulative_target = 1 << scale_factor;
+        if (scale_factor >= 32U)
+            return AVERROR_INVALIDDATA;
+        cumulative_target = 1U << scale_factor;
 
         if (scaled_cumul_prob > cumulative_target) {
             av_log(rac->avctx, AV_LOG_ERROR,