mpegvideo: Fix undefined negative shifts in mpeg_motion_internal
authorLuca Barbato <lu_zero@gentoo.org>
Fri, 4 Mar 2016 15:57:29 +0000 (16:57 +0100)
committerDiego Biurrun <diego@biurrun.de>
Thu, 12 Jan 2017 14:36:21 +0000 (15:36 +0100)
Bug-Id: 980
Bug-Id: CVE-2016-9820

Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
(cherry picked from commit 0242351390643d176b10600c2eb854414f9559e6)
Signed-off-by: Sean McGovern <gseanmcg@gmail.com>
(cherry picked from commit e17bcfbecc268ba00cb55025095d70b1025e6c7d)
Signed-off-by: Diego Biurrun <diego@biurrun.de>
libavcodec/mpegvideo_common.h

index be7f7a5..5fd5702 100644 (file)
@@ -316,7 +316,7 @@ if(s->quarter_sample)
             }
             s->dsp.emulated_edge_mc(s->edge_emu_buffer, ptr_y, s->linesize,
                                 17, 17+field_based,
-                                src_x, src_y<<field_based,
+                                src_x, src_y * (1 << field_based),
                                 s->h_edge_pos, s->v_edge_pos);
             ptr_y = s->edge_emu_buffer;
             if(!CONFIG_GRAY || !(s->flags&CODEC_FLAG_GRAY)){
@@ -324,12 +324,12 @@ if(s->quarter_sample)
                 s->dsp.emulated_edge_mc(uvbuf ,
                                     ptr_cb, s->uvlinesize,
                                     9, 9+field_based,
-                                    uvsrc_x, uvsrc_y<<field_based,
+                                    uvsrc_x, uvsrc_y * (1 << field_based),
                                     s->h_edge_pos>>1, s->v_edge_pos>>1);
                 s->dsp.emulated_edge_mc(uvbuf+16,
                                     ptr_cr, s->uvlinesize,
                                     9, 9+field_based,
-                                    uvsrc_x, uvsrc_y<<field_based,
+                                    uvsrc_x, uvsrc_y * (1 << field_based),
                                     s->h_edge_pos>>1, s->v_edge_pos>>1);
                 ptr_cb= uvbuf;
                 ptr_cr= uvbuf+16;
@@ -512,18 +512,18 @@ static inline void qpel_motion(MpegEncContext *s,
     if(   (unsigned)src_x > FFMAX(s->h_edge_pos - (motion_x&3) - 16, 0)
        || (unsigned)src_y > FFMAX(   v_edge_pos - (motion_y&3) - h , 0)){
         s->dsp.emulated_edge_mc(s->edge_emu_buffer, ptr_y, s->linesize,
-                            17, 17+field_based, src_x, src_y<<field_based,
+                            17, 17+field_based, src_x, src_y * (1 << field_based),
                             s->h_edge_pos, s->v_edge_pos);
         ptr_y= s->edge_emu_buffer;
         if(!CONFIG_GRAY || !(s->flags&CODEC_FLAG_GRAY)){
             uint8_t *uvbuf= s->edge_emu_buffer + 18*s->linesize;
             s->dsp.emulated_edge_mc(uvbuf, ptr_cb, s->uvlinesize,
                                 9, 9 + field_based,
-                                uvsrc_x, uvsrc_y<<field_based,
+                                uvsrc_x, uvsrc_y * (1 << field_based),
                                 s->h_edge_pos>>1, s->v_edge_pos>>1);
             s->dsp.emulated_edge_mc(uvbuf + 16, ptr_cr, s->uvlinesize,
                                 9, 9 + field_based,
-                                uvsrc_x, uvsrc_y<<field_based,
+                                uvsrc_x, uvsrc_y * (1 << field_based),
                                 s->h_edge_pos>>1, s->v_edge_pos>>1);
             ptr_cb= uvbuf;
             ptr_cr= uvbuf + 16;