wrapper/libavc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "Decoder: Fix integer overflow when scaling motion vectors"

Browse source
This commit is contained in:
Ray Essick 2020-10-11 05:09:38 +00:00 • committed by Gerrit Code Review
commit e76f029dc4
2 changed files with 34 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

30
decoder/ih264d_parse_bslice.c
View file

@ -1197,8 +1197,8 @@ void ih264d_get_implicit_weights(dec_struct_t *ps_dec)
UWORD8 i, j;
struct pic_buffer_t *ps_pic_buff0, *ps_pic_buff1;
WORD16 i2_dist_scale_factor;
WORD16 i16_tb, i16_td, i16_tx;
WORD32 i4_tb, i4_td;
WORD16 i2_tb, i2_td, i2_tx;
WORD64 i8_tb, i8_td;
WORD32 i4_poc0, i4_poc1;
UWORD32 ui_temp0, ui_temp1;
UWORD8 uc_num_ref_idx_l0_active, uc_num_ref_idx_l1_active;
@ -1220,13 +1220,13 @@ void ih264d_get_implicit_weights(dec_struct_t *ps_dec)
if(i4_poc1 != i4_poc0)
{
i4_tb = ps_dec->ps_cur_pic->i4_poc - i4_poc0;
i16_tb = CLIP_S8(i4_tb);
i4_td = i4_poc1 - i4_poc0;
i16_td = CLIP_S8(i4_td);
i16_tx = (16384 + ABS(SIGN_POW2_DIV(i16_td, 1))) / i16_td;
i8_tb = (WORD64)ps_dec->ps_cur_pic->i4_poc - i4_poc0;
i2_tb = CLIP_S8(i8_tb);
i8_td = (WORD64)i4_poc1 - i4_poc0;
i2_td = CLIP_S8(i8_td);
i2_tx = (16384 + ABS(SIGN_POW2_DIV(i2_td, 1))) / i2_td;
i2_dist_scale_factor = CLIP_S11(
(((i16_tb * i16_tx) + 32) >> 6));
(((i2_tb * i2_tx) + 32) >> 6));
if(/*((u4_poc1 - u4_poc0) == 0) ||*/
(!(ps_pic_buff1->u1_is_short && ps_pic_buff0->u1_is_short))
@ -1290,14 +1290,14 @@ void ih264d_get_implicit_weights(dec_struct_t *ps_dec)
i4_poc1 = ps_pic_buff1->i4_poc;
if(i4_poc1 != i4_poc0)
{
i4_tb = i4_cur_poc - i4_poc0;
i16_tb = CLIP_S8(i4_tb);
i4_td = i4_poc1 - i4_poc0;
i16_td = CLIP_S8(i4_td);
i16_tx = (16384 + ABS(SIGN_POW2_DIV(i16_td, 1)))
/ i16_td;
i8_tb = (WORD64)i4_cur_poc - i4_poc0;
i2_tb = CLIP_S8(i8_tb);
i8_td = (WORD64)i4_poc1 - i4_poc0;
i2_td = CLIP_S8(i8_td);
i2_tx = (16384 + ABS(SIGN_POW2_DIV(i2_td, 1)))
/ i2_td;
i2_dist_scale_factor = CLIP_S11(
(((i16_tb * i16_tx) + 32) >> 6));
(((i2_tb * i2_tx) + 32) >> 6));
if(/*((u4_poc1 - u4_poc0) == 0) ||*/
(!(ps_pic_buff1->u1_is_short && ps_pic_buff0->u1_is_short))

36
decoder/ih264d_process_bslice.c
View file

@ -756,7 +756,7 @@ WORD32 ih264d_decode_temporal_direct(dec_struct_t * ps_dec,
}
{
WORD16 i16_td;
WORD32 diff;
WORD64 diff;
if(c_refFrm0 >= 0)
{
i2_mv_x0 = ps_mv->i2_mv[0];
@ -782,7 +782,7 @@ WORD32 ih264d_decode_temporal_direct(dec_struct_t * ps_dec,
i2_mv_y0 *= 2;
}
diff = pic1_poc - pic0_poc;
diff = (WORD64)pic1_poc - pic0_poc;
i16_td = CLIP_S8(diff);
if((ps_pic_buff0->u1_is_short == 0) || (i16_td == 0))
{
@ -791,21 +791,21 @@ WORD32 ih264d_decode_temporal_direct(dec_struct_t * ps_dec,
}
else
{
WORD16 i16_tb, i16_tx, i2_dist_scale_factor, i16_temp;
WORD16 i2_tb, i2_tx, i2_dist_scale_factor, i2_temp;
diff = cur_poc - pic0_poc;
i16_tb = CLIP_S8(diff);
diff = (WORD64)cur_poc - pic0_poc;
i2_tb = CLIP_S8(diff);
i16_tx = (16384 + ABS(SIGN_POW2_DIV(i16_td, 1))) / i16_td;
i2_tx = (16384 + ABS(SIGN_POW2_DIV(i16_td, 1))) / i16_td;
i2_dist_scale_factor = CLIP_S11(
(((i16_tb * i16_tx) + 32) >> 6));
i16_temp = (i2_mv_x0 * i2_dist_scale_factor + 128) >> 8;
i2_mv_x1 = i16_temp - i2_mv_x0;
i2_mv_x0 = i16_temp;
(((i2_tb * i2_tx) + 32) >> 6));
i2_temp = (i2_mv_x0 * i2_dist_scale_factor + 128) >> 8;
i2_mv_x1 = i2_temp - i2_mv_x0;
i2_mv_x0 = i2_temp;
i16_temp = (i2_mv_y0 * i2_dist_scale_factor + 128) >> 8;
i2_mv_y1 = i16_temp - i2_mv_y0;
i2_mv_y0 = i16_temp;
i2_temp = (i2_mv_y0 * i2_dist_scale_factor + 128) >> 8;
i2_mv_y1 = i2_temp - i2_mv_y0;
i2_mv_y0 = i2_temp;
}
{
mv_pred_t *ps_mv;
@ -2304,8 +2304,9 @@ void ih264d_fld_to_mbaff(dec_struct_t *ps_dec,
{
if(ABS(ps_col_pic->i4_top_field_order_cnt
- ps_dec->ps_cur_pic->i4_poc) >=
ABS(ps_dec->ps_cur_pic->i4_poc - ps_col_pic->i4_bottom_field_order_cnt))
- (WORD64)ps_dec->ps_cur_pic->i4_poc) >=
ABS((WORD64)ps_dec->ps_cur_pic->i4_poc
- ps_col_pic->i4_bottom_field_order_cnt))
{
ps_col_pic = ps_dec->ps_ref_pic_buf_lx[1][MAX_REF_BUFS];
}
@ -2336,8 +2337,9 @@ void ih264d_fld_to_mbaff(dec_struct_t *ps_dec,
if(u1_is_cur_mb_fld == 0)
{
if(ABS(ps_col_pic->i4_top_field_order_cnt
- ps_dec->ps_cur_pic->i4_poc) >=
ABS(ps_dec->ps_cur_pic->i4_poc - ps_col_pic->i4_bottom_field_order_cnt))
- (WORD64)ps_dec->ps_cur_pic->i4_poc) >=
ABS((WORD64)ps_dec->ps_cur_pic->i4_poc
- ps_col_pic->i4_bottom_field_order_cnt))
{
u2_sub_mb_ofst += 0x10;
}