diff options
| author | James Zern <jzern@google.com> | 2021-10-01 13:46:02 -0700 |
|---|---|---|
| committer | James Zern <jzern@google.com> | 2021-10-01 15:52:38 -0700 |
| commit | fccaa5fa7a3e134949f5ea9fe3d4f3c388d4243b (patch) | |
| tree | 8e1f3efc6fa42aa8630cc8df7462451f674c7079 /vp9/encoder | |
| parent | b68877a7ebfe764714f8ce7aeb2a7f6d12b77989 (diff) | |
| download | libvpx-fccaa5fa7a3e134949f5ea9fe3d4f3c388d4243b.tar libvpx-fccaa5fa7a3e134949f5ea9fe3d4f3c388d4243b.tar.gz libvpx-fccaa5fa7a3e134949f5ea9fe3d4f3c388d4243b.tar.bz2 libvpx-fccaa5fa7a3e134949f5ea9fe3d4f3c388d4243b.zip | |
{vp8,vp9}_set_roi_map: fix validation with INT_MIN
previously ranges were checked with abs() whose behavior is undefined
with INT_MIN. this fixes a crash when the original value is returned and
it later used as and offset into a table.
Bug: webm:1742
Change-Id: I345970b75c46699587a4fbc4a059e59277f4c2c8
Diffstat (limited to 'vp9/encoder')
| -rw-r--r-- | vp9/encoder/vp9_encoder.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/vp9/encoder/vp9_encoder.c b/vp9/encoder/vp9_encoder.c index 6cd8cb80e..7e80835f6 100644 --- a/vp9/encoder/vp9_encoder.c +++ b/vp9/encoder/vp9_encoder.c @@ -654,10 +654,15 @@ static void init_level_info(Vp9LevelInfo *level_info) { } static int check_seg_range(int seg_data[8], int range) { - return !(abs(seg_data[0]) > range || abs(seg_data[1]) > range || - abs(seg_data[2]) > range || abs(seg_data[3]) > range || - abs(seg_data[4]) > range || abs(seg_data[5]) > range || - abs(seg_data[6]) > range || abs(seg_data[7]) > range); + int i; + for (i = 0; i < 8; ++i) { + // Note abs() alone can't be used as the behavior of abs(INT_MIN) is + // undefined. + if (seg_data[i] > range || seg_data[i] < -range) { + return 0; + } + } + return 1; } VP9_LEVEL vp9_get_level(const Vp9LevelSpec *const level_spec) { |