[FFmpeg-devel] [PATCH] avcodec/vvcdec: check pred flag to fix undefined beavhiours

[Nuo Mi <nuomi2021@gmail.com>]

libavcodec/vvc/vvc_inter.c:823:18: runtime error: signed integer overflow: 1426128896 + 1426128896 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavcodec/vvc/vvc_inter.c:823:18
---
 libavcodec/vvc/vvc_inter.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/libavcodec/vvc/vvc_inter.c b/libavcodec/vvc/vvc_inter.c
index d5be32aa14..48c566b097 100644
--- a/libavcodec/vvc/vvc_inter.c
+++ b/libavcodec/vvc/vvc_inter.c
@@ -816,13 +816,16 @@ static void derive_affine_mvc(MvField *mvc, const VVCFrameContext *fc, const MvF
     const int hs = fc->ps.sps->hshift[1];
     const int vs = fc->ps.sps->vshift[1];
     const MvField* mv2 = ff_vvc_get_mvf(fc, x0 + hs * sbw, y0 + vs * sbh);
+
     *mvc = *mv;
-    mvc->mv[0].x += mv2->mv[0].x;
-    mvc->mv[0].y += mv2->mv[0].y;
-    mvc->mv[1].x += mv2->mv[1].x;
-    mvc->mv[1].y += mv2->mv[1].y;
-    ff_vvc_round_mv(mvc->mv + 0, 0, 1);
-    ff_vvc_round_mv(mvc->mv + 1, 0, 1);
+    for (int i = L0; i <= L1; i++) {
+        PredFlag mask = 1 << i;
+        if (mv2->pred_flag & mask) {
+            mvc->mv[i].x += mv2->mv[i].x;
+            mvc->mv[i].y += mv2->mv[i].y;
+            ff_vvc_round_mv(mvc->mv + i, 0, 1);
+        }
+    }
 }
 
 static void pred_affine_blk(VVCLocalContext *lc)
-- 
2.25.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".