sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-28 15:19:38 +03:00
Code Activity

avcodec/hpel_template: Fix unintentional usage of unsigned offsets

Browse Source 
The value of sizeof() is of type size_t which means that
an expression like
src1[i * src_stride1 + 4 * (int)sizeof(pixel)]
will use a very large offset if src_stride1 is sufficiently negative.
It works in practice (because it is correct modulo SIZE_MAX),
but UBSan treats it as error:
libavcodec/hpel_template.c:104:1: runtime error: addition of unsigned offset to 0x7ffdfa0391d8 overflowed to 0x7ffdfa0391cc
Fix this by casting sizeof(pixel) to int.

(This has been uncovered by a checkasm test for the hpeldsp
which will be added in a later commit.)

Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This commit is contained in:
Andreas Rheinhardt
2025-09-23 05:34:37 +02:00
parent b316a1bdd1
commit 89f2016ece
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/hpel_template.c
View File

@@ -40,9 +40,9 @@ static inline void FUNC(OPNAME ## _pixels8_l2)(uint8_t *dst, \
a = AV_RN4P(&src1[i * src_stride1]); \
b = AV_RN4P(&src2[i * src_stride2]); \
OP(*((pixel4 *) &dst[i * dst_stride]), rnd_avg_pixel4(a, b)); \
a = AV_RN4P(&src1[i * src_stride1 + 4 * sizeof(pixel)]); \
b = AV_RN4P(&src2[i * src_stride2 + 4 * sizeof(pixel)]); \
OP(*((pixel4 *) &dst[i * dst_stride + 4 * sizeof(pixel)]), \
a = AV_RN4P(&src1[i * src_stride1 + 4 * (int)sizeof(pixel)]); \
b = AV_RN4P(&src2[i * src_stride2 + 4 * (int)sizeof(pixel)]); \
OP(*((pixel4 *) &dst[i * dst_stride + 4 * (int)sizeof(pixel)]), \
rnd_avg_pixel4(a, b)); \
} \
} \