This logic, meant to detect any negative or too high value, fails
if the second parameter may also be negative, such as when video
dimensions are <= the size of one macroblock
---
libavcodec/vc1dec.c | 20 ++++++++++----------
1 files changed, 10 insertions(+), 10 deletions(-)
diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c
index 0340dc2..d9ce884 100644
--- a/libavcodec/vc1dec.c
+++ b/libavcodec/vc1dec.c
@@ -568,8 +568,8 @@ static void vc1_mc_1mv(VC1Context *v, int dir)
}
if (v->rangeredfrm || (v->mv_mode == MV_PMODE_INTENSITY_COMP)
- || (unsigned)(src_x - s->mspel) > s->h_edge_pos - (mx&3) - 16 -
s->mspel * 3
- || (unsigned)(src_y - s->mspel) > v_edge_pos - (my&3) - 16 -
s->mspel * 3) {
+ || (unsigned)(src_x - s->mspel) > FFMAX(s->h_edge_pos - (mx&3) - 16 -
s->mspel * 3, 0)
+ || (unsigned)(src_y - s->mspel) > FFMAX(v_edge_pos - (my&3) - 16 -
s->mspel * 3, 0)) {
uint8_t *uvbuf = s->edge_emu_buffer + 19 * s->linesize;
srcY -= s->mspel * (1 + s->linesize);
@@ -799,8 +799,8 @@ static void vc1_mc_4mv_luma(VC1Context *v, int n, int dir)
if (fieldmv && (src_y & 1) && src_y < 4)
src_y--;
if (v->rangeredfrm || (v->mv_mode == MV_PMODE_INTENSITY_COMP)
- || (unsigned)(src_x - s->mspel) > s->h_edge_pos - (mx & 3) - 8 -
s->mspel * 2
- || (unsigned)(src_y - (s->mspel << fieldmv)) > v_edge_pos - (my & 3) -
((8 + s->mspel * 2) << fieldmv)) {
+ || (unsigned)(src_x - s->mspel) > FFMAX(s->h_edge_pos - (mx & 3) - 8 -
s->mspel * 2, 0)
+ || (unsigned)(src_y - (s->mspel << fieldmv)) > FFMAX(v_edge_pos - (my
& 3) - ((8 + s->mspel * 2) << fieldmv), 0)) {
srcY -= s->mspel * (1 + (s->linesize << fieldmv));
/* check emulate edge stride and offset */
s->dsp.emulated_edge_mc(s->edge_emu_buffer, srcY, s->linesize,
@@ -998,8 +998,8 @@ static void vc1_mc_4mv_chroma(VC1Context *v, int dir)
}
if (v->rangeredfrm || (v->mv_mode == MV_PMODE_INTENSITY_COMP)
- || (unsigned)uvsrc_x > (s->h_edge_pos >> 1) - 9
- || (unsigned)uvsrc_y > (v_edge_pos >> 1) - 9) {
+ || (unsigned)uvsrc_x > FFMAX((s->h_edge_pos >> 1) - 9, 0)
+ || (unsigned)uvsrc_y > FFMAX((v_edge_pos >> 1) - 9, 0)) {
s->dsp.emulated_edge_mc(s->edge_emu_buffer , srcU, s->uvlinesize,
8 + 1, 8 + 1, uvsrc_x, uvsrc_y,
s->h_edge_pos >> 1, v_edge_pos >> 1);
@@ -1102,8 +1102,8 @@ static void vc1_mc_4mv_chroma4(VC1Context *v)
if (fieldmv && (uvsrc_y & 1) && uvsrc_y < 2)
uvsrc_y--;
if ((v->mv_mode == MV_PMODE_INTENSITY_COMP)
- || (unsigned)uvsrc_x > (s->h_edge_pos >> 1) - 5
- || (unsigned)uvsrc_y > v_edge_pos - (5 << fieldmv)) {
+ || (unsigned)uvsrc_x > FFMAX((s->h_edge_pos >> 1) - 5, 0)
+ || (unsigned)uvsrc_y > FFMAX(v_edge_pos - (5 << fieldmv), 0)) {
s->dsp.emulated_edge_mc(s->edge_emu_buffer, srcU, s->uvlinesize,
5, (5 << fieldmv), uvsrc_x, uvsrc_y,
s->h_edge_pos >> 1, v_edge_pos);
@@ -2007,8 +2007,8 @@ static void vc1_interp_mc(VC1Context *v)
}
if (v->rangeredfrm
- || (unsigned)(src_x - s->mspel) > s->h_edge_pos - (mx & 3) - 16 -
s->mspel * 3
- || (unsigned)(src_y - s->mspel) > v_edge_pos - (my & 3) - 16 -
s->mspel * 3) {
+ || (unsigned)(src_x - s->mspel) > FFMAX(s->h_edge_pos - (mx & 3) - 16
- s->mspel * 3, 0)
+ || (unsigned)(src_y - s->mspel) > FFMAX(v_edge_pos - (my & 3) - 16
- s->mspel * 3, 0)) {
uint8_t *uvbuf = s->edge_emu_buffer + 19 * s->linesize;
srcY -= s->mspel * (1 + s->linesize);
--
1.7.5.4
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
