avcodec/lagarith: fix integer overflow

Fixes: asan_heap-oob_1bf48fa_2513_lag-yuy2.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

diff --git a/libavcodec/lagarith.c b/libavcodec/lagarith.c
index 5f97d0f806d60b8e98c053bce0969ca961f8ff8f..2c6d70c0650b6f920b77bbcb0e0e8d98e18fc1b5 100644 (file)
--- a/libavcodec/lagarith.c
+++ b/libavcodec/lagarith.c
@@ -128,7 +128,7 @@ static int lag_decode_prob(GetBitContext *gb, uint32_t *value)
     }
 
     val  = get_bits_long(gb, bits);
-    val |= 1 << bits;
+    val |= 1U << bits;
 
     *value = val - 1;