[FFmpeg-cvslog] avcodec/cavsdsp: use av_clip_uint8() for idct

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Mon Sep 19 15:25:38 2016 +0200| [69b00a7fb6faa1b19b5687a5762ff4f94d5ff9aa] | 
committer: Michael Niedermayer

avcodec/cavsdsp: use av_clip_uint8() for idct

Fixes out of array read
Fixes: 1.swf

Found-by: 连一汉 
Tested-by: 连一汉 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 0e318f110bcd6bb8e7de9127f2747272e60f48d7)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=69b00a7fb6faa1b19b5687a5762ff4f94d5ff9aa
---

 libavcodec/cavsdsp.c | 17 -
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/libavcodec/cavsdsp.c b/libavcodec/cavsdsp.c
index 91f6d73..df9490a 100644
--- a/libavcodec/cavsdsp.c
+++ b/libavcodec/cavsdsp.c
@@ -188,7 +188,6 @@ static void cavs_filter_ch_c(uint8_t *d, int stride, int 
alpha, int beta, int tc
 static void cavs_idct8_add_c(uint8_t *dst, int16_t *block, int stride) {
 int i;
 int16_t (*src)[8] = (int16_t(*)[8])block;
-const uint8_t *cm = ff_crop_tab + MAX_NEG_CROP;
 
 src[0][0] += 8;
 
@@ -243,14 +242,14 @@ static void cavs_idct8_add_c(uint8_t *dst, int16_t 
*block, int stride) {
 const int b2 = a5 - a7;
 const int b3 = a4 - a6;
 
-dst[i + 0*stride] = cm[ dst[i + 0*stride] + ((b0 + b4) >> 7)];
-dst[i + 1*stride] = cm[ dst[i + 1*stride] + ((b1 + b5) >> 7)];
-dst[i + 2*stride] = cm[ dst[i + 2*stride] + ((b2 + b6) >> 7)];
-dst[i + 3*stride] = cm[ dst[i + 3*stride] + ((b3 + b7) >> 7)];
-dst[i + 4*stride] = cm[ dst[i + 4*stride] + ((b3 - b7) >> 7)];
-dst[i + 5*stride] = cm[ dst[i + 5*stride] + ((b2 - b6) >> 7)];
-dst[i + 6*stride] = cm[ dst[i + 6*stride] + ((b1 - b5) >> 7)];
-dst[i + 7*stride] = cm[ dst[i + 7*stride] + ((b0 - b4) >> 7)];
+dst[i + 0*stride] = av_clip_uint8( dst[i + 0*stride] + ((b0 + b4) >> 
7));
+dst[i + 1*stride] = av_clip_uint8( dst[i + 1*stride] + ((b1 + b5) >> 
7));
+dst[i + 2*stride] = av_clip_uint8( dst[i + 2*stride] + ((b2 + b6) >> 
7));
+dst[i + 3*stride] = av_clip_uint8( dst[i + 3*stride] + ((b3 + b7) >> 
7));
+dst[i + 4*stride] = av_clip_uint8( dst[i + 4*stride] + ((b3 - b7) >> 
7));
+dst[i + 5*stride] = av_clip_uint8( dst[i + 5*stride] + ((b2 - b6) >> 
7));
+dst[i + 6*stride] = av_clip_uint8( dst[i + 6*stride] + ((b1 - b5) >> 
7));
+dst[i + 7*stride] = av_clip_uint8( dst[i + 7*stride] + ((b0 - b4) >> 
7));
 }
 }
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/cavsdsp: use av_clip_uint8() for idct

[Michael Niedermayer]

ffmpeg | branch: release/3.1 | Michael Niedermayer  | 
Mon Sep 19 15:25:38 2016 +0200| [9d738e6968757d4e70c8e07e0b720ac0004accc4] | 
committer: Michael Niedermayer

avcodec/cavsdsp: use av_clip_uint8() for idct

Fixes out of array read
Fixes: 1.swf

Found-by: 连一汉 
Tested-by: 连一汉 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 0e318f110bcd6bb8e7de9127f2747272e60f48d7)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9d738e6968757d4e70c8e07e0b720ac0004accc4
---

 libavcodec/cavsdsp.c | 17 -
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/libavcodec/cavsdsp.c b/libavcodec/cavsdsp.c
index 91f6d73..df9490a 100644
--- a/libavcodec/cavsdsp.c
+++ b/libavcodec/cavsdsp.c
@@ -188,7 +188,6 @@ static void cavs_filter_ch_c(uint8_t *d, int stride, int 
alpha, int beta, int tc
 static void cavs_idct8_add_c(uint8_t *dst, int16_t *block, int stride) {
 int i;
 int16_t (*src)[8] = (int16_t(*)[8])block;
-const uint8_t *cm = ff_crop_tab + MAX_NEG_CROP;
 
 src[0][0] += 8;
 
@@ -243,14 +242,14 @@ static void cavs_idct8_add_c(uint8_t *dst, int16_t 
*block, int stride) {
 const int b2 = a5 - a7;
 const int b3 = a4 - a6;
 
-dst[i + 0*stride] = cm[ dst[i + 0*stride] + ((b0 + b4) >> 7)];
-dst[i + 1*stride] = cm[ dst[i + 1*stride] + ((b1 + b5) >> 7)];
-dst[i + 2*stride] = cm[ dst[i + 2*stride] + ((b2 + b6) >> 7)];
-dst[i + 3*stride] = cm[ dst[i + 3*stride] + ((b3 + b7) >> 7)];
-dst[i + 4*stride] = cm[ dst[i + 4*stride] + ((b3 - b7) >> 7)];
-dst[i + 5*stride] = cm[ dst[i + 5*stride] + ((b2 - b6) >> 7)];
-dst[i + 6*stride] = cm[ dst[i + 6*stride] + ((b1 - b5) >> 7)];
-dst[i + 7*stride] = cm[ dst[i + 7*stride] + ((b0 - b4) >> 7)];
+dst[i + 0*stride] = av_clip_uint8( dst[i + 0*stride] + ((b0 + b4) >> 
7));
+dst[i + 1*stride] = av_clip_uint8( dst[i + 1*stride] + ((b1 + b5) >> 
7));
+dst[i + 2*stride] = av_clip_uint8( dst[i + 2*stride] + ((b2 + b6) >> 
7));
+dst[i + 3*stride] = av_clip_uint8( dst[i + 3*stride] + ((b3 + b7) >> 
7));
+dst[i + 4*stride] = av_clip_uint8( dst[i + 4*stride] + ((b3 - b7) >> 
7));
+dst[i + 5*stride] = av_clip_uint8( dst[i + 5*stride] + ((b2 - b6) >> 
7));
+dst[i + 6*stride] = av_clip_uint8( dst[i + 6*stride] + ((b1 - b5) >> 
7));
+dst[i + 7*stride] = av_clip_uint8( dst[i + 7*stride] + ((b0 - b4) >> 
7));
 }
 }
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/cavsdsp: use av_clip_uint8() for idct

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer  | Mon 
Sep 19 15:25:38 2016 +0200| [0e318f110bcd6bb8e7de9127f2747272e60f48d7] | 
committer: Michael Niedermayer

avcodec/cavsdsp: use av_clip_uint8() for idct

Fixes out of array read
Fixes: 1.swf

Found-by: 连一汉 
Tested-by: 连一汉 
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0e318f110bcd6bb8e7de9127f2747272e60f48d7
---

 libavcodec/cavsdsp.c | 17 -
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/libavcodec/cavsdsp.c b/libavcodec/cavsdsp.c
index 91f6d73..df9490a 100644
--- a/libavcodec/cavsdsp.c
+++ b/libavcodec/cavsdsp.c
@@ -188,7 +188,6 @@ static void cavs_filter_ch_c(uint8_t *d, int stride, int 
alpha, int beta, int tc
 static void cavs_idct8_add_c(uint8_t *dst, int16_t *block, int stride) {
 int i;
 int16_t (*src)[8] = (int16_t(*)[8])block;
-const uint8_t *cm = ff_crop_tab + MAX_NEG_CROP;
 
 src[0][0] += 8;
 
@@ -243,14 +242,14 @@ static void cavs_idct8_add_c(uint8_t *dst, int16_t 
*block, int stride) {
 const int b2 = a5 - a7;
 const int b3 = a4 - a6;
 
-dst[i + 0*stride] = cm[ dst[i + 0*stride] + ((b0 + b4) >> 7)];
-dst[i + 1*stride] = cm[ dst[i + 1*stride] + ((b1 + b5) >> 7)];
-dst[i + 2*stride] = cm[ dst[i + 2*stride] + ((b2 + b6) >> 7)];
-dst[i + 3*stride] = cm[ dst[i + 3*stride] + ((b3 + b7) >> 7)];
-dst[i + 4*stride] = cm[ dst[i + 4*stride] + ((b3 - b7) >> 7)];
-dst[i + 5*stride] = cm[ dst[i + 5*stride] + ((b2 - b6) >> 7)];
-dst[i + 6*stride] = cm[ dst[i + 6*stride] + ((b1 - b5) >> 7)];
-dst[i + 7*stride] = cm[ dst[i + 7*stride] + ((b0 - b4) >> 7)];
+dst[i + 0*stride] = av_clip_uint8( dst[i + 0*stride] + ((b0 + b4) >> 
7));
+dst[i + 1*stride] = av_clip_uint8( dst[i + 1*stride] + ((b1 + b5) >> 
7));
+dst[i + 2*stride] = av_clip_uint8( dst[i + 2*stride] + ((b2 + b6) >> 
7));
+dst[i + 3*stride] = av_clip_uint8( dst[i + 3*stride] + ((b3 + b7) >> 
7));
+dst[i + 4*stride] = av_clip_uint8( dst[i + 4*stride] + ((b3 - b7) >> 
7));
+dst[i + 5*stride] = av_clip_uint8( dst[i + 5*stride] + ((b2 - b6) >> 
7));
+dst[i + 6*stride] = av_clip_uint8( dst[i + 6*stride] + ((b1 - b5) >> 
7));
+dst[i + 7*stride] = av_clip_uint8( dst[i + 7*stride] + ((b0 - b4) >> 
7));
 }
 }
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog