From befc36d4a791447e36699d0390dff5205cc6dd3f Mon Sep 17 00:00:00 2001
From: Alexander Voronov <avoronov@graphics.cs.msu.ru>
Date: Thu, 2 Oct 2014 17:14:12 +0400
Subject: [PATCH] Fix invalid memory access in inter prediction (issue 853).
Change-Id: I5a566d6ade720f212a60c0ad5d6f1ee1d1d37f2e
---
vp9/common/vp9_convolve.c | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/vp9/common/vp9_convolve.c b/vp9/common/vp9_convolve.c
index ad70e59bf3..973d0244cf 100644
--- a/vp9/common/vp9_convolve.c
+++ b/vp9/common/vp9_convolve.c
@@ -130,16 +130,14 @@ static void convolve(const uint8_t *src, ptrdiff_t src_stride,
// --Require an additional SUBPEL_TAPS rows for the 8-tap filter tails.
// --((64 - 1) * 32 + 15) >> 4 + 8 = 135.
uint8_t temp[135 * 64];
- int intermediate_height = (((h - 1) * y_step_q4 + 15) >> 4) + SUBPEL_TAPS;
+ int intermediate_height =
+ (((h - 1) * y_step_q4 + y0_q4) >> SUBPEL_BITS) + SUBPEL_TAPS;
assert(w <= 64);
assert(h <= 64);
assert(y_step_q4 <= 32);
assert(x_step_q4 <= 32);
- if (intermediate_height < h)
- intermediate_height = h;
-
convolve_horiz(src - src_stride * (SUBPEL_TAPS / 2 - 1), src_stride, temp, 64,
x_filters, x0_q4, x_step_q4, w, intermediate_height);
convolve_vert(temp + 64 * (SUBPEL_TAPS / 2 - 1), 64, dst, dst_stride,
@@ -407,16 +405,14 @@ static void high_convolve(const uint8_t *src, ptrdiff_t src_stride,
// --Require an additional SUBPEL_TAPS rows for the 8-tap filter tails.
// --((64 - 1) * 32 + 15) >> 4 + 8 = 135.
uint16_t temp[64 * 135];
- int intermediate_height = (((h - 1) * y_step_q4 + 15) >> 4) + SUBPEL_TAPS;
+ int intermediate_height =
+ (((h - 1) * y_step_q4 + y0_q4) >> SUBPEL_BITS) + SUBPEL_TAPS;
assert(w <= 64);
assert(h <= 64);
assert(y_step_q4 <= 32);
assert(x_step_q4 <= 32);
- if (intermediate_height < h)
- intermediate_height = h;
-
high_convolve_horiz(src - src_stride * (SUBPEL_TAPS / 2 - 1),
src_stride, CONVERT_TO_BYTEPTR(temp), 64,
x_filters, x0_q4, x_step_q4, w,
--
GitLab