diff options
| author | Yaowu Xu <yaowu@google.com> | 2013-09-20 13:29:59 -0700 |
|---|---|---|
| committer | Yaowu Xu <yaowu@google.com> | 2013-09-23 17:15:55 -0700 |
| commit | fbb62c6d2bd1951cb1a69bdba13c582d2939f93e (patch) | |
| tree | 1ecec5c14897da773e6cb655dd91307f08efb5c8 /vp8/decoder | |
| parent | 8c2e5e49645feea4c9bff63a324200823812c7c1 (diff) | |
| download | libvpx-fbb62c6d2bd1951cb1a69bdba13c582d2939f93e.tar libvpx-fbb62c6d2bd1951cb1a69bdba13c582d2939f93e.tar.gz libvpx-fbb62c6d2bd1951cb1a69bdba13c582d2939f93e.tar.bz2 libvpx-fbb62c6d2bd1951cb1a69bdba13c582d2939f93e.zip | |
fix integer overflow in vp8
Change-Id: I62550a7a883115f3ce878710cf3bb039bea54390
Diffstat (limited to 'vp8/decoder')
| -rw-r--r-- | vp8/decoder/decodemv.c | 8 | ||||
| -rw-r--r-- | vp8/decoder/decodframe.c | 2 |
2 files changed, 5 insertions, 5 deletions
diff --git a/vp8/decoder/decodemv.c b/vp8/decoder/decodemv.c index 8027a07ed..759d842c3 100644 --- a/vp8/decoder/decodemv.c +++ b/vp8/decoder/decodemv.c @@ -110,8 +110,8 @@ static int read_mvcomponent(vp8_reader *r, const MV_CONTEXT *mvc) static void read_mv(vp8_reader *r, MV *mv, const MV_CONTEXT *mvc) { - mv->row = (short)(read_mvcomponent(r, mvc) << 1); - mv->col = (short)(read_mvcomponent(r, ++mvc) << 1); + mv->row = (short)(read_mvcomponent(r, mvc) * 2); + mv->col = (short)(read_mvcomponent(r, ++mvc) * 2); } @@ -292,9 +292,9 @@ static void decode_split_mv(vp8_reader *const bc, MODE_INFO *mi, blockmv.as_int = 0; if( vp8_read(bc, prob[2]) ) { - blockmv.as_mv.row = read_mvcomponent(bc, &mvc[0]) << 1; + blockmv.as_mv.row = read_mvcomponent(bc, &mvc[0]) * 2; blockmv.as_mv.row += best_mv.as_mv.row; - blockmv.as_mv.col = read_mvcomponent(bc, &mvc[1]) << 1; + blockmv.as_mv.col = read_mvcomponent(bc, &mvc[1]) * 2; blockmv.as_mv.col += best_mv.as_mv.col; } } diff --git a/vp8/decoder/decodframe.c b/vp8/decoder/decodframe.c index 0050c11c1..50ee9c52f 100644 --- a/vp8/decoder/decodframe.c +++ b/vp8/decoder/decodframe.c @@ -576,7 +576,7 @@ static void decode_mb_rows(VP8D_COMP *pbi) xd->left_available = 0; - xd->mb_to_top_edge = -((mb_row * 16)) << 3; + xd->mb_to_top_edge = -((mb_row * 16) << 3); xd->mb_to_bottom_edge = ((pc->mb_rows - 1 - mb_row) * 16) << 3; xd->recon_above[0] = dst_buffer[0] + recon_yoffset; |