avcodec/h264idct_template: Fix multiple runtime error: signed integer overflow

Fixes: 677/clusterfuzz-testcase-6635120628858880

Michael Niedermayer committed 9 years ago

Commit 4ea77441 parent 26a7d6a1 file · +13 −13Browse files

Unified · Split

@@ -40,10 +40,10 @@ void FUNCC(ff_h264_idct_add)(uint8_t _dst, int16_t _block, int stride) · 39 unmodified lines
40	40	block[0] += 1 << 5;
41	41
42	42	for(i=0; i<4; i++){
43		− const int z0= block[i + 40] + block[i + 42];
44		− const int z1= block[i + 40] - block[i + 42];
45		− const int z2= (block[i + 41]>>1) - block[i + 43];
46		− const int z3= block[i + 41] + (block[i + 43]>>1);
	43	+ const SUINT z0= block[i + 40] + block[i + 42];
	44	+ const SUINT z1= block[i + 40] - block[i + 42];
	45	+ const SUINT z2= (block[i + 41]>>1) - block[i + 43];
	46	+ const SUINT z3= block[i + 41] + (block[i + 43]>>1);
47	47
48	48	block[i + 4*0]= z0 + z3;
49	49	block[i + 4*1]= z1 + z2;
@@ -52,15 +52,15 @@ void FUNCC(ff_h264_idct_add)(uint8_t _dst, int16_t _block, int stride) · 2 unmodified lines
52	52	}
53	53
54	54	for(i=0; i<4; i++){
55		− const int z0= block[0 + 4i] + block[2 + 4i];
56		− const int z1= block[0 + 4i] - block[2 + 4i];
57		− const int z2= (block[1 + 4i]>>1) - block[3 + 4i];
58		− const int z3= block[1 + 4i] + (block[3 + 4i]>>1);
59		−
60		− dst[i + 0stride]= av_clip_pixel(dst[i + 0stride] + ((z0 + z3) >> 6));
61		− dst[i + 1stride]= av_clip_pixel(dst[i + 1stride] + ((z1 + z2) >> 6));
62		− dst[i + 2stride]= av_clip_pixel(dst[i + 2stride] + ((z1 - z2) >> 6));
63		− dst[i + 3stride]= av_clip_pixel(dst[i + 3stride] + ((z0 - z3) >> 6));
	55	+ const SUINT z0= block[0 + 4i] + (SUINT)block[2 + 4i];
	56	+ const SUINT z1= block[0 + 4i] - (SUINT)block[2 + 4i];
	57	+ const SUINT z2= (block[1 + 4i]>>1) - (SUINT)block[3 + 4i];
	58	+ const SUINT z3= block[1 + 4i] + (SUINT)(block[3 + 4i]>>1);
	59	+
	60	+ dst[i + 0stride]= av_clip_pixel(dst[i + 0stride] + ((int)(z0 + z3) >> 6));
	61	+ dst[i + 1stride]= av_clip_pixel(dst[i + 1stride] + ((int)(z1 + z2) >> 6));
	62	+ dst[i + 2stride]= av_clip_pixel(dst[i + 2stride] + ((int)(z1 - z2) >> 6));
	63	+ dst[i + 3stride]= av_clip_pixel(dst[i + 3stride] + ((int)(z0 - z3) >> 6));
64	64	}
65	65
66	66	memset(block, 0, 16 * sizeof(dctcoef));

avcodec/h264idct_template: Fix multiple runtime error: signed integer overflow

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code