From 89f2016ece77868cc1982ae104d56b25aaf519c3 Mon Sep 17 00:00:00 2001 From: Andreas Rheinhardt Date: Tue, 23 Sep 2025 05:34:37 +0200 Subject: [PATCH] avcodec/hpel_template: Fix unintentional usage of unsigned offsets The value of sizeof() is of type size_t which means that an expression like src1[i * src_stride1 + 4 * (int)sizeof(pixel)] will use a very large offset if src_stride1 is sufficiently negative. It works in practice (because it is correct modulo SIZE_MAX), but UBSan treats it as error: libavcodec/hpel_template.c:104:1: runtime error: addition of unsigned offset to 0x7ffdfa0391d8 overflowed to 0x7ffdfa0391cc Fix this by casting sizeof(pixel) to int. (This has been uncovered by a checkasm test for the hpeldsp which will be added in a later commit.) Reviewed-by: Lynne Signed-off-by: Andreas Rheinhardt --- libavcodec/hpel_template.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/hpel_template.c b/libavcodec/hpel_template.c index fccfe7610f..77ebcd74a2 100644 --- a/libavcodec/hpel_template.c +++ b/libavcodec/hpel_template.c @@ -40,9 +40,9 @@ static inline void FUNC(OPNAME ## _pixels8_l2)(uint8_t *dst, \ a = AV_RN4P(&src1[i * src_stride1]); \ b = AV_RN4P(&src2[i * src_stride2]); \ OP(*((pixel4 *) &dst[i * dst_stride]), rnd_avg_pixel4(a, b)); \ - a = AV_RN4P(&src1[i * src_stride1 + 4 * sizeof(pixel)]); \ - b = AV_RN4P(&src2[i * src_stride2 + 4 * sizeof(pixel)]); \ - OP(*((pixel4 *) &dst[i * dst_stride + 4 * sizeof(pixel)]), \ + a = AV_RN4P(&src1[i * src_stride1 + 4 * (int)sizeof(pixel)]); \ + b = AV_RN4P(&src2[i * src_stride2 + 4 * (int)sizeof(pixel)]); \ + OP(*((pixel4 *) &dst[i * dst_stride + 4 * (int)sizeof(pixel)]), \ rnd_avg_pixel4(a, b)); \ } \ } \