Files
ffmpeg/libavcodec
Andreas Cadhalpun 31dd783631 vp8: change mv_{min,max}.{x,y} type to int
If one of the dimensions is larger than 8176, s->mb_width or
s->mb_height is larger than 511, leading to an int16_t overflow of
s->mv_max.{x,y}. This then causes av_clip to be called with amin > amax.

Changing the type to int avoids the overflow and has no negative
effect, because s->mv_max is only used in clamp_mv for clipping.
Since mv_max.{x,y} is positive and mv_min.{x,y} negative, av_clip can't
increase the absolute value. The input to av_clip is an int16_t, and
thus the output fits into int16_t as well.

For additional safety, s->mv_{min,max}.{x,y} are clipped to int16_t range
before use.

Reviewed-by: Ronald S. Bultje <rsbultje@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 6fdbaa2b7f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-20 04:43:40 +02:00
..
2015-03-06 14:37:44 +01:00
2015-03-13 13:04:31 +01:00
2015-03-03 13:57:42 +01:00
2015-03-03 13:57:42 +01:00
2015-07-20 04:43:39 +02:00
2015-02-21 20:38:13 +01:00
2015-07-20 04:43:39 +02:00
2015-02-06 19:07:29 +01:00
2015-02-05 09:48:54 +00:00
2015-05-15 20:40:26 +02:00
2015-02-17 11:27:42 -05:00
2015-03-28 20:01:22 +01:00
2015-02-08 00:12:46 +01:00
2015-02-14 19:45:23 +00:00
2015-03-14 14:26:28 +01:00
2015-06-19 10:37:30 +02:00
2015-02-21 15:50:19 +01:00
2015-02-10 14:20:32 +00:00
2015-02-01 19:13:38 +01:00
2015-03-02 19:32:23 +01:00
2015-03-28 11:59:04 +01:00
2015-02-27 09:30:13 +00:00
2015-02-18 10:21:56 -05:00
2015-02-24 03:15:42 +01:00
2015-02-06 21:02:08 +01:00
2015-02-15 17:28:02 +01:00
2015-02-14 12:48:41 +00:00
2015-05-15 10:04:51 +02:00
2015-02-04 09:45:41 +00:00