From fbb62c6d2bd1951cb1a69bdba13c582d2939f93e Mon Sep 17 00:00:00 2001 From: Yaowu Xu Date: Fri, 20 Sep 2013 13:29:59 -0700 Subject: fix integer overflow in vp8 Change-Id: I62550a7a883115f3ce878710cf3bb039bea54390 --- vp8/decoder/decodemv.c | 8 ++++---- vp8/decoder/decodframe.c | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) (limited to 'vp8/decoder') diff --git a/vp8/decoder/decodemv.c b/vp8/decoder/decodemv.c index 8027a07ed..759d842c3 100644 --- a/vp8/decoder/decodemv.c +++ b/vp8/decoder/decodemv.c @@ -110,8 +110,8 @@ static int read_mvcomponent(vp8_reader *r, const MV_CONTEXT *mvc) static void read_mv(vp8_reader *r, MV *mv, const MV_CONTEXT *mvc) { - mv->row = (short)(read_mvcomponent(r, mvc) << 1); - mv->col = (short)(read_mvcomponent(r, ++mvc) << 1); + mv->row = (short)(read_mvcomponent(r, mvc) * 2); + mv->col = (short)(read_mvcomponent(r, ++mvc) * 2); } @@ -292,9 +292,9 @@ static void decode_split_mv(vp8_reader *const bc, MODE_INFO *mi, blockmv.as_int = 0; if( vp8_read(bc, prob[2]) ) { - blockmv.as_mv.row = read_mvcomponent(bc, &mvc[0]) << 1; + blockmv.as_mv.row = read_mvcomponent(bc, &mvc[0]) * 2; blockmv.as_mv.row += best_mv.as_mv.row; - blockmv.as_mv.col = read_mvcomponent(bc, &mvc[1]) << 1; + blockmv.as_mv.col = read_mvcomponent(bc, &mvc[1]) * 2; blockmv.as_mv.col += best_mv.as_mv.col; } } diff --git a/vp8/decoder/decodframe.c b/vp8/decoder/decodframe.c index 0050c11c1..50ee9c52f 100644 --- a/vp8/decoder/decodframe.c +++ b/vp8/decoder/decodframe.c @@ -576,7 +576,7 @@ static void decode_mb_rows(VP8D_COMP *pbi) xd->left_available = 0; - xd->mb_to_top_edge = -((mb_row * 16)) << 3; + xd->mb_to_top_edge = -((mb_row * 16) << 3); xd->mb_to_bottom_edge = ((pc->mb_rows - 1 - mb_row) * 16) << 3; xd->recon_above[0] = dst_buffer[0] + recon_yoffset; -- cgit v1.2.3