shithub: dav1d

Info  •  Files  •  Log  •  Branches

intra_pred: fix ubsan issues with max_width/height in 2f251bd11528

Seen with clusterfuzz-testcase-minimized-dav1d_fuzzer-5712042518904832.

--- a/src/ipred_tmpl.c

+++ b/src/ipred_tmpl.c

@@ -349,7 +349,7 @@

     assert(strength > 0);

     int i = 0;

-    for (; i < lim_from; i++)

+    for (; i < imin(sz, lim_from); i++)

         out[i] = in[iclip(i, from, to - 1)];

     for (; i < imin(lim_to, sz); i++) {

         int s = 0;

--- a/src/recon_tmpl.c

+++ b/src/recon_tmpl.c

@@ -986,7 +986,7 @@

                                                  angle | sm_uv_fl,

                                                  (f->cur.p.p.w + ss_hor -

                                                   4 * (t->bx & ~ss_hor)) >> ss_hor,

-                                                 (f->cur.p.p.w + ss_ver -

+                                                 (f->cur.p.p.h + ss_ver -

                                                   4 * (t->by & ~ss_ver)) >> ss_ver);

                         if (DEBUG_BLOCK_INFO && DEBUG_B_PIXELS) {

                             hex_dump(edge - uv_t_dim->h * 4, uv_t_dim->h * 4,