shithub: dav1d

Info  •  Files  •  Log  •  Branches

intrabc: use visible width/height in mv correction

Prevents adjusting intra block copy motion vectors to values pointing
out of the current tile. This happens with not entirely visible blocks in
a one super block wide/high tile. Fixes an use of uninitilized value in
inv_txfm_add_c() with
clusterfuzz-testcase-minimized-dav1d_fuzzer_mt-5746740678885376. Credits
to oss-fuzz.

--- a/src/decode.c

+++ b/src/decode.c

@@ -1264,8 +1264,8 @@

         }

         int src_left   = t->bx * 4 + (b->mv[0].x >> 3);

         int src_top    = t->by * 4 + (b->mv[0].y >> 3);

-        int src_right  = src_left + bw4 * 4;

-        int src_bottom = src_top  + bh4 * 4;

+        int src_right  = src_left + w4 * 4;

+        int src_bottom = src_top  + h4 * 4;

         // check against left or right tile boundary and adjust if necessary

         if (src_left < border_left) {