From 97e169f6ced2246e70e4e05702e9f81e3587e7d4 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 1 Jul 2026 06:09:33 +0200 Subject: [PATCH] swscale/output: avoid signed overflow in yuv2rgb_write_full luma scaling Fixes: 523522305/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-4574409678716928 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg (cherry picked from commit f50e22c68d1e579a3e2818a7d93d6eed092ad387) Signed-off-by: Michael Niedermayer --- libswscale/output.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libswscale/output.c b/libswscale/output.c index cea7fb1185..760dca642e 100644 --- a/libswscale/output.c +++ b/libswscale/output.c @@ -2003,8 +2003,8 @@ static av_always_inline void yuv2rgb_write_full(SwsInternal *c, int isrgb8 = target == AV_PIX_FMT_BGR8 || target == AV_PIX_FMT_RGB8; Y -= c->yuv2rgb_y_offset; - Y *= c->yuv2rgb_y_coeff; - Y += 1 << 21; + Y *= (unsigned)c->yuv2rgb_y_coeff; + Y += 1U << 21; R = (unsigned)Y + V*(unsigned)c->yuv2rgb_v2r_coeff; G = (unsigned)Y + V*(unsigned)c->yuv2rgb_v2g_coeff + U*(unsigned)c->yuv2rgb_u2g_coeff; B = (unsigned)Y + U*(unsigned)c->yuv2rgb_u2b_coeff;