From 2b475307dc11be9a1c3cc4358102c76a7f386a51 Mon Sep 17 00:00:00 2001 From: Henrik Gramner Date: Tue, 21 Nov 2023 20:47:50 +0100 Subject: [PATCH] Fix tile_start_off calculations for extremely large frame sizes The tile start offset, in pixels, can exceed the range of a signed int. --- src/decode.c | 13 +++++++------ src/internal.h | 2 +- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/src/decode.c b/src/decode.c index fdf5a6b..eed9dfb 100644 --- a/src/decode.c +++ b/src/decode.c @@ -2470,7 +2470,7 @@ static void setup_tile(Dav1dTileState *const ts, const Dav1dFrameContext *const f, const uint8_t *const data, const size_t sz, const int tile_row, const int tile_col, - const int tile_start_off) + const unsigned tile_start_off) { const int col_sb_start = f->frame_hdr->tiling.col_start_sb[tile_col]; const int col_sb128_start = col_sb_start >> !f->seq_hdr->sb128; @@ -2843,15 +2843,16 @@ int dav1d_decode_frame_init(Dav1dFrameContext *const f) { const uint8_t *const size_mul = ss_size_mul[f->cur.p.layout]; const int hbd = !!f->seq_hdr->hbd; if (c->n_fc > 1) { + const unsigned sb_step4 = f->sb_step * 4; int tile_idx = 0; for (int tile_row = 0; tile_row < f->frame_hdr->tiling.rows; tile_row++) { - int row_off = f->frame_hdr->tiling.row_start_sb[tile_row] * - f->sb_step * 4 * f->sb128w * 128; - int b_diff = (f->frame_hdr->tiling.row_start_sb[tile_row + 1] - - f->frame_hdr->tiling.row_start_sb[tile_row]) * f->sb_step * 4; + const unsigned row_off = f->frame_hdr->tiling.row_start_sb[tile_row] * + sb_step4 * f->sb128w * 128; + const unsigned b_diff = (f->frame_hdr->tiling.row_start_sb[tile_row + 1] - + f->frame_hdr->tiling.row_start_sb[tile_row]) * sb_step4; for (int tile_col = 0; tile_col < f->frame_hdr->tiling.cols; tile_col++) { f->frame_thread.tile_start_off[tile_idx++] = row_off + b_diff * - f->frame_hdr->tiling.col_start_sb[tile_col] * f->sb_step * 4; + f->frame_hdr->tiling.col_start_sb[tile_col] * sb_step4; } } diff --git a/src/internal.h b/src/internal.h index 631c5a8..72f6560 100644 --- a/src/internal.h +++ b/src/internal.h @@ -289,7 +289,7 @@ struct Dav1dFrameContext { int prog_sz; int cbi_sz, pal_sz, pal_idx_sz, cf_sz; // start offsets per tile - int *tile_start_off; + unsigned *tile_start_off; } frame_thread; // loopfilter -- 2.43.0