diff mbox series

[FFmpeg-devel] avcodec/vvcdec: fix undefined behaviours for derive_affine_mvc

Message ID TYSPR06MB643345C354177A579BE899CBAA5C2@TYSPR06MB6433.apcprd06.prod.outlook.com
State Accepted
Commit 72b1237ece9acf509787a68357f4fb0857c893d9
Headers show
Series [FFmpeg-devel] avcodec/vvcdec: fix undefined behaviours for derive_affine_mvc | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Nuo Mi March 3, 2024, 2:04 p.m. UTC 
libavcodec/vvc/vvc_inter.c:823:18: runtime error: signed integer overflow: 1426128896 + 1426128896 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavcodec/vvc/vvc_inter.c:823:18

Suggested-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
---
 libavcodec/vvc/vvc_inter.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

Comments

Nuo Mi March 4, 2024, 12:42 p.m. UTC | #1 
On Sun, Mar 3, 2024 at 10:04 PM Nuo Mi <nuomi2021@gmail.com> wrote:

> libavcodec/vvc/vvc_inter.c:823:18: runtime error: signed integer overflow:
> 1426128896 + 1426128896 cannot be represented in type 'int'
> SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
> libavcodec/vvc/vvc_inter.c:823:18
>
> Suggested-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
> ---
>  libavcodec/vvc/vvc_inter.c | 11 +++++++----
>  1 file changed, 7 insertions(+), 4 deletions(-)
>
> diff --git a/libavcodec/vvc/vvc_inter.c b/libavcodec/vvc/vvc_inter.c
> index d5be32aa14..c5629f7f6f 100644
> --- a/libavcodec/vvc/vvc_inter.c
> +++ b/libavcodec/vvc/vvc_inter.c
> @@ -817,10 +817,13 @@ static void derive_affine_mvc(MvField *mvc, const
> VVCFrameContext *fc, const MvF
>      const int vs = fc->ps.sps->vshift[1];
>      const MvField* mv2 = ff_vvc_get_mvf(fc, x0 + hs * sbw, y0 + vs * sbh);
>      *mvc = *mv;
> -    mvc->mv[0].x += mv2->mv[0].x;
> -    mvc->mv[0].y += mv2->mv[0].y;
> -    mvc->mv[1].x += mv2->mv[1].x;
> -    mvc->mv[1].y += mv2->mv[1].y;
> +
> +    // Due to different pred_flag, one of the motion vectors may have an
> invalid value.
> +    // Cast them to an unsigned type to avoid undefined behavior.
> +    mvc->mv[0].x += (unsigned int)mv2->mv[0].x;
> +    mvc->mv[0].y += (unsigned int)mv2->mv[0].y;
> +    mvc->mv[1].x += (unsigned int)mv2->mv[1].x;
> +    mvc->mv[1].y += (unsigned int)mv2->mv[1].y;
>
pushed.

>      ff_vvc_round_mv(mvc->mv + 0, 0, 1);
>      ff_vvc_round_mv(mvc->mv + 1, 0, 1);
>  }
> --
> 2.25.1
>
>
diff mbox series

Patch

diff --git a/libavcodec/vvc/vvc_inter.c b/libavcodec/vvc/vvc_inter.c
index d5be32aa14..c5629f7f6f 100644
--- a/libavcodec/vvc/vvc_inter.c
+++ b/libavcodec/vvc/vvc_inter.c
@@ -817,10 +817,13 @@  static void derive_affine_mvc(MvField *mvc, const VVCFrameContext *fc, const MvF
     const int vs = fc->ps.sps->vshift[1];
     const MvField* mv2 = ff_vvc_get_mvf(fc, x0 + hs * sbw, y0 + vs * sbh);
     *mvc = *mv;
-    mvc->mv[0].x += mv2->mv[0].x;
-    mvc->mv[0].y += mv2->mv[0].y;
-    mvc->mv[1].x += mv2->mv[1].x;
-    mvc->mv[1].y += mv2->mv[1].y;
+
+    // Due to different pred_flag, one of the motion vectors may have an invalid value.
+    // Cast them to an unsigned type to avoid undefined behavior.
+    mvc->mv[0].x += (unsigned int)mv2->mv[0].x;
+    mvc->mv[0].y += (unsigned int)mv2->mv[0].y;
+    mvc->mv[1].x += (unsigned int)mv2->mv[1].x;
+    mvc->mv[1].y += (unsigned int)mv2->mv[1].y;
     ff_vvc_round_mv(mvc->mv + 0, 0, 1);
     ff_vvc_round_mv(mvc->mv + 1, 0, 1);
 }