Module: libav
Branch: release/0.8
Commit: 0f1a8b63792cd41003667c546154a748c7b608f7
Author: Luca Barbato <lu_z...@gentoo.org>
Committer: Diego Biurrun <di...@biurrun.de>
Date: Fri Mar 4 16:57:29 2016 +0100
mpegvideo: Fix undefined negative shifts in mpeg_motion_internal
Bug-Id: 980
Bug-Id: CVE-2016-9820
Signed-off-by: Vittorio Giovara <vittorio.giov...@gmail.com>
(cherry picked from commit 0242351390643d176b10600c2eb854414f9559e6)
Signed-off-by: Sean McGovern <gsean...@gmail.com>
(cherry picked from commit e17bcfbecc268ba00cb55025095d70b1025e6c7d)
Signed-off-by: Diego Biurrun <di...@biurrun.de>
---
libavcodec/mpegvideo_common.h | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/libavcodec/mpegvideo_common.h b/libavcodec/mpegvideo_common.h
index be7f7a5..5fd5702 100644
--- a/libavcodec/mpegvideo_common.h
+++ b/libavcodec/mpegvideo_common.h
@@ -316,7 +316,7 @@ if(s->quarter_sample)
}
s->dsp.emulated_edge_mc(s->edge_emu_buffer, ptr_y, s->linesize,
17, 17+field_based,
- src_x, src_y<<field_based,
+ src_x, src_y * (1 << field_based),
s->h_edge_pos, s->v_edge_pos);
ptr_y = s->edge_emu_buffer;
if(!CONFIG_GRAY || !(s->flags&CODEC_FLAG_GRAY)){
@@ -324,12 +324,12 @@ if(s->quarter_sample)
s->dsp.emulated_edge_mc(uvbuf ,
ptr_cb, s->uvlinesize,
9, 9+field_based,
- uvsrc_x, uvsrc_y<<field_based,
+ uvsrc_x, uvsrc_y * (1 << field_based),
s->h_edge_pos>>1, s->v_edge_pos>>1);
s->dsp.emulated_edge_mc(uvbuf+16,
ptr_cr, s->uvlinesize,
9, 9+field_based,
- uvsrc_x, uvsrc_y<<field_based,
+ uvsrc_x, uvsrc_y * (1 << field_based),
s->h_edge_pos>>1, s->v_edge_pos>>1);
ptr_cb= uvbuf;
ptr_cr= uvbuf+16;
@@ -512,18 +512,18 @@ static inline void qpel_motion(MpegEncContext *s,
if( (unsigned)src_x > FFMAX(s->h_edge_pos - (motion_x&3) - 16, 0)
|| (unsigned)src_y > FFMAX( v_edge_pos - (motion_y&3) - h , 0)){
s->dsp.emulated_edge_mc(s->edge_emu_buffer, ptr_y, s->linesize,
- 17, 17+field_based, src_x, src_y<<field_based,
+ 17, 17+field_based, src_x, src_y * (1 <<
field_based),
s->h_edge_pos, s->v_edge_pos);
ptr_y= s->edge_emu_buffer;
if(!CONFIG_GRAY || !(s->flags&CODEC_FLAG_GRAY)){
uint8_t *uvbuf= s->edge_emu_buffer + 18*s->linesize;
s->dsp.emulated_edge_mc(uvbuf, ptr_cb, s->uvlinesize,
9, 9 + field_based,
- uvsrc_x, uvsrc_y<<field_based,
+ uvsrc_x, uvsrc_y * (1 << field_based),
s->h_edge_pos>>1, s->v_edge_pos>>1);
s->dsp.emulated_edge_mc(uvbuf + 16, ptr_cr, s->uvlinesize,
9, 9 + field_based,
- uvsrc_x, uvsrc_y<<field_based,
+ uvsrc_x, uvsrc_y * (1 << field_based),
s->h_edge_pos>>1, s->v_edge_pos>>1);
ptr_cb= uvbuf;
ptr_cr= uvbuf + 16;
_______________________________________________
libav-commits mailing list
libav-commits@libav.org
https://lists.libav.org/mailman/listinfo/libav-commits
