ffmpeg/libavcodec/vp3dsp.c
Michael Niedermayer c7e775f712 avcodec/vp3dsp: Use unsigned constant to avoid undefined integer overflow in ff_vp3dsp_set_bounding_values()
Fixes: signed integer overflow: 64 * 33686018 cannot be represented in type 'int'
Fixes: 26911/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-4904975073017856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-11-13 18:01:54 +01:00

495 lines
15 KiB
C

/*
* Copyright (C) 2004 The FFmpeg project
*
* This file is part of FFmpeg.
*
* FFmpeg is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* FFmpeg is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with FFmpeg; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
/**
* @file
* Standard C DSP-oriented functions cribbed from the original VP3
* source code.
*/
#include "libavutil/attributes.h"
#include "libavutil/common.h"
#include "libavutil/intreadwrite.h"
#include "libavutil/avassert.h"
#include "avcodec.h"
#include "rnd_avg.h"
#include "vp3dsp.h"
#define IdctAdjustBeforeShift 8
#define xC1S7 64277
#define xC2S6 60547
#define xC3S5 54491
#define xC4S4 46341
#define xC5S3 36410
#define xC6S2 25080
#define xC7S1 12785
#define M(a, b) ((int)((SUINT)(a) * (b)) >> 16)
static av_always_inline void idct(uint8_t *dst, ptrdiff_t stride,
int16_t *input, int type)
{
int16_t *ip = input;
int A, B, C, D, Ad, Bd, Cd, Dd, E, F, G, H;
int Ed, Gd, Add, Bdd, Fd, Hd;
int i;
/* Inverse DCT on the rows now */
for (i = 0; i < 8; i++) {
/* Check for non-zero values */
if (ip[0 * 8] | ip[1 * 8] | ip[2 * 8] | ip[3 * 8] |
ip[4 * 8] | ip[5 * 8] | ip[6 * 8] | ip[7 * 8]) {
A = M(xC1S7, ip[1 * 8]) + M(xC7S1, ip[7 * 8]);
B = M(xC7S1, ip[1 * 8]) - M(xC1S7, ip[7 * 8]);
C = M(xC3S5, ip[3 * 8]) + M(xC5S3, ip[5 * 8]);
D = M(xC3S5, ip[5 * 8]) - M(xC5S3, ip[3 * 8]);
Ad = M(xC4S4, (A - C));
Bd = M(xC4S4, (B - D));
Cd = A + C;
Dd = B + D;
E = M(xC4S4, (ip[0 * 8] + ip[4 * 8]));
F = M(xC4S4, (ip[0 * 8] - ip[4 * 8]));
G = M(xC2S6, ip[2 * 8]) + M(xC6S2, ip[6 * 8]);
H = M(xC6S2, ip[2 * 8]) - M(xC2S6, ip[6 * 8]);
Ed = E - G;
Gd = E + G;
Add = F + Ad;
Bdd = Bd - H;
Fd = F - Ad;
Hd = Bd + H;
/* Final sequence of operations over-write original inputs. */
ip[0 * 8] = Gd + Cd;
ip[7 * 8] = Gd - Cd;
ip[1 * 8] = Add + Hd;
ip[2 * 8] = Add - Hd;
ip[3 * 8] = Ed + Dd;
ip[4 * 8] = Ed - Dd;
ip[5 * 8] = Fd + Bdd;
ip[6 * 8] = Fd - Bdd;
}
ip += 1; /* next row */
}
ip = input;
for (i = 0; i < 8; i++) {
/* Check for non-zero values (bitwise or faster than ||) */
if (ip[1] | ip[2] | ip[3] |
ip[4] | ip[5] | ip[6] | ip[7]) {
A = M(xC1S7, ip[1]) + M(xC7S1, ip[7]);
B = M(xC7S1, ip[1]) - M(xC1S7, ip[7]);
C = M(xC3S5, ip[3]) + M(xC5S3, ip[5]);
D = M(xC3S5, ip[5]) - M(xC5S3, ip[3]);
Ad = M(xC4S4, (A - C));
Bd = M(xC4S4, (B - D));
Cd = A + C;
Dd = B + D;
E = M(xC4S4, (ip[0] + ip[4])) + 8;
F = M(xC4S4, (ip[0] - ip[4])) + 8;
if (type == 1) { // HACK
E += 16 * 128;
F += 16 * 128;
}
G = M(xC2S6, ip[2]) + M(xC6S2, ip[6]);
H = M(xC6S2, ip[2]) - M(xC2S6, ip[6]);
Ed = E - G;
Gd = E + G;
Add = F + Ad;
Bdd = Bd - H;
Fd = F - Ad;
Hd = Bd + H;
/* Final sequence of operations over-write original inputs. */
if (type == 1) {
dst[0 * stride] = av_clip_uint8((Gd + Cd) >> 4);
dst[7 * stride] = av_clip_uint8((Gd - Cd) >> 4);
dst[1 * stride] = av_clip_uint8((Add + Hd) >> 4);
dst[2 * stride] = av_clip_uint8((Add - Hd) >> 4);
dst[3 * stride] = av_clip_uint8((Ed + Dd) >> 4);
dst[4 * stride] = av_clip_uint8((Ed - Dd) >> 4);
dst[5 * stride] = av_clip_uint8((Fd + Bdd) >> 4);
dst[6 * stride] = av_clip_uint8((Fd - Bdd) >> 4);
} else {
dst[0 * stride] = av_clip_uint8(dst[0 * stride] + ((Gd + Cd) >> 4));
dst[7 * stride] = av_clip_uint8(dst[7 * stride] + ((Gd - Cd) >> 4));
dst[1 * stride] = av_clip_uint8(dst[1 * stride] + ((Add + Hd) >> 4));
dst[2 * stride] = av_clip_uint8(dst[2 * stride] + ((Add - Hd) >> 4));
dst[3 * stride] = av_clip_uint8(dst[3 * stride] + ((Ed + Dd) >> 4));
dst[4 * stride] = av_clip_uint8(dst[4 * stride] + ((Ed - Dd) >> 4));
dst[5 * stride] = av_clip_uint8(dst[5 * stride] + ((Fd + Bdd) >> 4));
dst[6 * stride] = av_clip_uint8(dst[6 * stride] + ((Fd - Bdd) >> 4));
}
} else {
if (type == 1) {
dst[0*stride] =
dst[1*stride] =
dst[2*stride] =
dst[3*stride] =
dst[4*stride] =
dst[5*stride] =
dst[6*stride] =
dst[7*stride] = av_clip_uint8(128 + ((xC4S4 * ip[0] + (IdctAdjustBeforeShift << 16)) >> 20));
} else {
if (ip[0]) {
int v = (xC4S4 * ip[0] + (IdctAdjustBeforeShift << 16)) >> 20;
dst[0 * stride] = av_clip_uint8(dst[0 * stride] + v);
dst[1 * stride] = av_clip_uint8(dst[1 * stride] + v);
dst[2 * stride] = av_clip_uint8(dst[2 * stride] + v);
dst[3 * stride] = av_clip_uint8(dst[3 * stride] + v);
dst[4 * stride] = av_clip_uint8(dst[4 * stride] + v);
dst[5 * stride] = av_clip_uint8(dst[5 * stride] + v);
dst[6 * stride] = av_clip_uint8(dst[6 * stride] + v);
dst[7 * stride] = av_clip_uint8(dst[7 * stride] + v);
}
}
}
ip += 8; /* next column */
dst++;
}
}
static av_always_inline void idct10(uint8_t *dst, ptrdiff_t stride,
int16_t *input, int type)
{
int16_t *ip = input;
int A, B, C, D, Ad, Bd, Cd, Dd, E, F, G, H;
int Ed, Gd, Add, Bdd, Fd, Hd;
int i;
/* Inverse DCT on the rows now */
for (i = 0; i < 4; i++) {
/* Check for non-zero values */
if (ip[0 * 8] | ip[1 * 8] | ip[2 * 8] | ip[3 * 8]) {
A = M(xC1S7, ip[1 * 8]);
B = M(xC7S1, ip[1 * 8]);
C = M(xC3S5, ip[3 * 8]);
D = -M(xC5S3, ip[3 * 8]);
Ad = M(xC4S4, (A - C));
Bd = M(xC4S4, (B - D));
Cd = A + C;
Dd = B + D;
E = M(xC4S4, ip[0 * 8]);
F = E;
G = M(xC2S6, ip[2 * 8]);
H = M(xC6S2, ip[2 * 8]);
Ed = E - G;
Gd = E + G;
Add = F + Ad;
Bdd = Bd - H;
Fd = F - Ad;
Hd = Bd + H;
/* Final sequence of operations over-write original inputs */
ip[0 * 8] = Gd + Cd;
ip[7 * 8] = Gd - Cd;
ip[1 * 8] = Add + Hd;
ip[2 * 8] = Add - Hd;
ip[3 * 8] = Ed + Dd;
ip[4 * 8] = Ed - Dd;
ip[5 * 8] = Fd + Bdd;
ip[6 * 8] = Fd - Bdd;
}
ip += 1;
}
ip = input;
for (i = 0; i < 8; i++) {
/* Check for non-zero values (bitwise or faster than ||) */
if (ip[0] | ip[1] | ip[2] | ip[3]) {
A = M(xC1S7, ip[1]);
B = M(xC7S1, ip[1]);
C = M(xC3S5, ip[3]);
D = -M(xC5S3, ip[3]);
Ad = M(xC4S4, (A - C));
Bd = M(xC4S4, (B - D));
Cd = A + C;
Dd = B + D;
E = M(xC4S4, ip[0]);
if (type == 1)
E += 16 * 128;
F = E;
G = M(xC2S6, ip[2]);
H = M(xC6S2, ip[2]);
Ed = E - G;
Gd = E + G;
Add = F + Ad;
Bdd = Bd - H;
Fd = F - Ad;
Hd = Bd + H;
Gd += 8;
Add += 8;
Ed += 8;
Fd += 8;
/* Final sequence of operations over-write original inputs. */
if (type == 1) {
dst[0 * stride] = av_clip_uint8((Gd + Cd) >> 4);
dst[7 * stride] = av_clip_uint8((Gd - Cd) >> 4);
dst[1 * stride] = av_clip_uint8((Add + Hd) >> 4);
dst[2 * stride] = av_clip_uint8((Add - Hd) >> 4);
dst[3 * stride] = av_clip_uint8((Ed + Dd) >> 4);
dst[4 * stride] = av_clip_uint8((Ed - Dd) >> 4);
dst[5 * stride] = av_clip_uint8((Fd + Bdd) >> 4);
dst[6 * stride] = av_clip_uint8((Fd - Bdd) >> 4);
} else {
dst[0 * stride] = av_clip_uint8(dst[0 * stride] + ((Gd + Cd) >> 4));
dst[7 * stride] = av_clip_uint8(dst[7 * stride] + ((Gd - Cd) >> 4));
dst[1 * stride] = av_clip_uint8(dst[1 * stride] + ((Add + Hd) >> 4));
dst[2 * stride] = av_clip_uint8(dst[2 * stride] + ((Add - Hd) >> 4));
dst[3 * stride] = av_clip_uint8(dst[3 * stride] + ((Ed + Dd) >> 4));
dst[4 * stride] = av_clip_uint8(dst[4 * stride] + ((Ed - Dd) >> 4));
dst[5 * stride] = av_clip_uint8(dst[5 * stride] + ((Fd + Bdd) >> 4));
dst[6 * stride] = av_clip_uint8(dst[6 * stride] + ((Fd - Bdd) >> 4));
}
} else {
if (type == 1) {
dst[0*stride] =
dst[1*stride] =
dst[2*stride] =
dst[3*stride] =
dst[4*stride] =
dst[5*stride] =
dst[6*stride] =
dst[7*stride] = 128;
}
}
ip += 8;
dst++;
}
}
void ff_vp3dsp_idct10_put(uint8_t *dest, ptrdiff_t stride, int16_t *block)
{
idct10(dest, stride, block, 1);
memset(block, 0, sizeof(*block) * 64);
}
void ff_vp3dsp_idct10_add(uint8_t *dest, ptrdiff_t stride, int16_t *block)
{
idct10(dest, stride, block, 2);
memset(block, 0, sizeof(*block) * 64);
}
static void vp3_idct_put_c(uint8_t *dest /* align 8 */, ptrdiff_t stride,
int16_t *block /* align 16 */)
{
idct(dest, stride, block, 1);
memset(block, 0, sizeof(*block) * 64);
}
static void vp3_idct_add_c(uint8_t *dest /* align 8 */, ptrdiff_t stride,
int16_t *block /* align 16 */)
{
idct(dest, stride, block, 2);
memset(block, 0, sizeof(*block) * 64);
}
static void vp3_idct_dc_add_c(uint8_t *dest /* align 8 */, ptrdiff_t stride,
int16_t *block /* align 16 */)
{
int i, dc = (block[0] + 15) >> 5;
for (i = 0; i < 8; i++) {
dest[0] = av_clip_uint8(dest[0] + dc);
dest[1] = av_clip_uint8(dest[1] + dc);
dest[2] = av_clip_uint8(dest[2] + dc);
dest[3] = av_clip_uint8(dest[3] + dc);
dest[4] = av_clip_uint8(dest[4] + dc);
dest[5] = av_clip_uint8(dest[5] + dc);
dest[6] = av_clip_uint8(dest[6] + dc);
dest[7] = av_clip_uint8(dest[7] + dc);
dest += stride;
}
block[0] = 0;
}
static av_always_inline void vp3_v_loop_filter_c(uint8_t *first_pixel, ptrdiff_t stride,
int *bounding_values, int count)
{
unsigned char *end;
int filter_value;
const ptrdiff_t nstride = -stride;
for (end = first_pixel + count; first_pixel < end; first_pixel++) {
filter_value = (first_pixel[2 * nstride] - first_pixel[stride]) +
(first_pixel[0] - first_pixel[nstride]) * 3;
filter_value = bounding_values[(filter_value + 4) >> 3];
first_pixel[nstride] = av_clip_uint8(first_pixel[nstride] + filter_value);
first_pixel[0] = av_clip_uint8(first_pixel[0] - filter_value);
}
}
static av_always_inline void vp3_h_loop_filter_c(uint8_t *first_pixel, ptrdiff_t stride,
int *bounding_values, int count)
{
unsigned char *end;
int filter_value;
for (end = first_pixel + count * stride; first_pixel != end; first_pixel += stride) {
filter_value = (first_pixel[-2] - first_pixel[1]) +
(first_pixel[ 0] - first_pixel[-1]) * 3;
filter_value = bounding_values[(filter_value + 4) >> 3];
first_pixel[-1] = av_clip_uint8(first_pixel[-1] + filter_value);
first_pixel[ 0] = av_clip_uint8(first_pixel[ 0] - filter_value);
}
}
#define LOOP_FILTER(prefix, suffix, dim, count) \
void prefix##_##dim##_loop_filter_##count##suffix(uint8_t *first_pixel, ptrdiff_t stride, \
int *bounding_values) \
{ \
vp3_##dim##_loop_filter_c(first_pixel, stride, bounding_values, count); \
}
static LOOP_FILTER(vp3,_c, v, 8)
static LOOP_FILTER(vp3,_c, h, 8)
LOOP_FILTER(ff_vp3dsp, , v, 12)
LOOP_FILTER(ff_vp3dsp, , h, 12)
static void put_no_rnd_pixels_l2(uint8_t *dst, const uint8_t *src1,
const uint8_t *src2, ptrdiff_t stride, int h)
{
int i;
for (i = 0; i < h; i++) {
uint32_t a, b;
a = AV_RN32(&src1[i * stride]);
b = AV_RN32(&src2[i * stride]);
AV_WN32A(&dst[i * stride], no_rnd_avg32(a, b));
a = AV_RN32(&src1[i * stride + 4]);
b = AV_RN32(&src2[i * stride + 4]);
AV_WN32A(&dst[i * stride + 4], no_rnd_avg32(a, b));
}
}
av_cold void ff_vp3dsp_init(VP3DSPContext *c, int flags)
{
c->put_no_rnd_pixels_l2 = put_no_rnd_pixels_l2;
c->idct_put = vp3_idct_put_c;
c->idct_add = vp3_idct_add_c;
c->idct_dc_add = vp3_idct_dc_add_c;
c->v_loop_filter = c->v_loop_filter_unaligned = vp3_v_loop_filter_8_c;
c->h_loop_filter = c->h_loop_filter_unaligned = vp3_h_loop_filter_8_c;
if (ARCH_ARM)
ff_vp3dsp_init_arm(c, flags);
if (ARCH_PPC)
ff_vp3dsp_init_ppc(c, flags);
if (ARCH_X86)
ff_vp3dsp_init_x86(c, flags);
if (ARCH_MIPS)
ff_vp3dsp_init_mips(c, flags);
}
/*
* This function initializes the loop filter boundary limits if the frame's
* quality index is different from the previous frame's.
*
* where sizeof(bounding_values_array) is 256 * sizeof(int)
*
* The filter_limit_values may not be larger than 127.
*/
void ff_vp3dsp_set_bounding_values(int * bounding_values_array, int filter_limit)
{
int *bounding_values = bounding_values_array + 127;
int x;
int value;
av_assert0(filter_limit < 128U);
/* set up the bounding values */
memset(bounding_values_array, 0, 256 * sizeof(int));
for (x = 0; x < filter_limit; x++) {
bounding_values[-x] = -x;
bounding_values[x] = x;
}
for (x = value = filter_limit; x < 128 && value; x++, value--) {
bounding_values[ x] = value;
bounding_values[-x] = -value;
}
if (value)
bounding_values[128] = value;
bounding_values[129] = bounding_values[130] = filter_limit * 0x02020202U;
}