From 1389b4c18d1042c196603ba66c25113bcee1738b Mon Sep 17 00:00:00 2001 From: Katerina Barone-Adesi Date: Wed, 2 Mar 2016 18:52:25 -0500 Subject: [PATCH] idct8x8: Fix undefined negative shifts The original code left-shifts negative values, which is undefined in the C99 specification (the one used during normal Libav compilation). This change multiplies by (1 << shift), which is functionally equivalent, but has defined behavior. With this change, fate-idct8x8 compiled with --fsanitize=undefined works. Bug-Id: 686 --- libavcodec/jfdctint_template.c | 4 ++-- libavcodec/jrevdct.c | 36 +++++++++++++++---------------- libavcodec/simple_idct_template.c | 10 ++++----- 3 files changed, 25 insertions(+), 25 deletions(-) diff --git a/libavcodec/jfdctint_template.c b/libavcodec/jfdctint_template.c index c6a1638107..3ea2f5dadc 100644 --- a/libavcodec/jfdctint_template.c +++ b/libavcodec/jfdctint_template.c @@ -216,8 +216,8 @@ static av_always_inline void FUNC(row_fdct)(int16_t *data) tmp11 = tmp1 + tmp2; tmp12 = tmp1 - tmp2; - dataptr[0] = (int16_t) ((tmp10 + tmp11) << PASS1_BITS); - dataptr[4] = (int16_t) ((tmp10 - tmp11) << PASS1_BITS); + dataptr[0] = (int16_t) ((tmp10 + tmp11) * (1 << PASS1_BITS)); + dataptr[4] = (int16_t) ((tmp10 - tmp11) * (1 << PASS1_BITS)); z1 = MULTIPLY(tmp12 + tmp13, FIX_0_541196100); dataptr[2] = (int16_t) DESCALE(z1 + MULTIPLY(tmp13, FIX_0_765366865), diff --git a/libavcodec/jrevdct.c b/libavcodec/jrevdct.c index 8261269b25..96a884ae87 100644 --- a/libavcodec/jrevdct.c +++ b/libavcodec/jrevdct.c @@ -251,8 +251,8 @@ void ff_j_rev_dct(DCTBLOCK data) /* AC terms all zero */ if (d0) { /* Compute a 32 bit value to assign. */ - int16_t dcval = (int16_t) (d0 << PASS1_BITS); - register int v = (dcval & 0xffff) | ((dcval << 16) & 0xffff0000); + int16_t dcval = (int16_t) (d0 * (1 << PASS1_BITS)); + register int v = (dcval & 0xffff) | ((dcval * (1 << 16)) & 0xffff0000); idataptr[0] = v; idataptr[1] = v; @@ -274,8 +274,8 @@ void ff_j_rev_dct(DCTBLOCK data) tmp2 = z1 + MULTIPLY(-d6, FIX_1_847759065); tmp3 = z1 + MULTIPLY(d2, FIX_0_765366865); - tmp0 = (d0 + d4) << CONST_BITS; - tmp1 = (d0 - d4) << CONST_BITS; + tmp0 = (d0 + d4) * CONST_SCALE; + tmp1 = (d0 - d4) * CONST_SCALE; tmp10 = tmp0 + tmp3; tmp13 = tmp0 - tmp3; @@ -286,8 +286,8 @@ void ff_j_rev_dct(DCTBLOCK data) tmp2 = MULTIPLY(-d6, FIX_1_306562965); tmp3 = MULTIPLY(d6, FIX_0_541196100); - tmp0 = (d0 + d4) << CONST_BITS; - tmp1 = (d0 - d4) << CONST_BITS; + tmp0 = (d0 + d4) * CONST_SCALE; + tmp1 = (d0 - d4) * CONST_SCALE; tmp10 = tmp0 + tmp3; tmp13 = tmp0 - tmp3; @@ -300,8 +300,8 @@ void ff_j_rev_dct(DCTBLOCK data) tmp2 = MULTIPLY(d2, FIX_0_541196100); tmp3 = MULTIPLY(d2, FIX_1_306562965); - tmp0 = (d0 + d4) << CONST_BITS; - tmp1 = (d0 - d4) << CONST_BITS; + tmp0 = (d0 + d4) * CONST_SCALE; + tmp1 = (d0 - d4) * CONST_SCALE; tmp10 = tmp0 + tmp3; tmp13 = tmp0 - tmp3; @@ -309,8 +309,8 @@ void ff_j_rev_dct(DCTBLOCK data) tmp12 = tmp1 - tmp2; } else { /* d0 != 0, d2 == 0, d4 != 0, d6 == 0 */ - tmp10 = tmp13 = (d0 + d4) << CONST_BITS; - tmp11 = tmp12 = (d0 - d4) << CONST_BITS; + tmp10 = tmp13 = (d0 + d4) * CONST_SCALE; + tmp11 = tmp12 = (d0 - d4) * CONST_SCALE; } } @@ -620,8 +620,8 @@ void ff_j_rev_dct(DCTBLOCK data) tmp2 = z1 + MULTIPLY(-d6, FIX_1_847759065); tmp3 = z1 + MULTIPLY(d2, FIX_0_765366865); - tmp0 = (d0 + d4) << CONST_BITS; - tmp1 = (d0 - d4) << CONST_BITS; + tmp0 = (d0 + d4) * CONST_SCALE; + tmp1 = (d0 - d4) * CONST_SCALE; tmp10 = tmp0 + tmp3; tmp13 = tmp0 - tmp3; @@ -632,8 +632,8 @@ void ff_j_rev_dct(DCTBLOCK data) tmp2 = MULTIPLY(-d6, FIX_1_306562965); tmp3 = MULTIPLY(d6, FIX_0_541196100); - tmp0 = (d0 + d4) << CONST_BITS; - tmp1 = (d0 - d4) << CONST_BITS; + tmp0 = (d0 + d4) * CONST_SCALE; + tmp1 = (d0 - d4) * CONST_SCALE; tmp10 = tmp0 + tmp3; tmp13 = tmp0 - tmp3; @@ -646,8 +646,8 @@ void ff_j_rev_dct(DCTBLOCK data) tmp2 = MULTIPLY(d2, FIX_0_541196100); tmp3 = MULTIPLY(d2, FIX_1_306562965); - tmp0 = (d0 + d4) << CONST_BITS; - tmp1 = (d0 - d4) << CONST_BITS; + tmp0 = (d0 + d4) * CONST_SCALE; + tmp1 = (d0 - d4) * CONST_SCALE; tmp10 = tmp0 + tmp3; tmp13 = tmp0 - tmp3; @@ -655,8 +655,8 @@ void ff_j_rev_dct(DCTBLOCK data) tmp12 = tmp1 - tmp2; } else { /* d0 != 0, d2 == 0, d4 != 0, d6 == 0 */ - tmp10 = tmp13 = (d0 + d4) << CONST_BITS; - tmp11 = tmp12 = (d0 - d4) << CONST_BITS; + tmp10 = tmp13 = (d0 + d4) * CONST_SCALE; + tmp11 = tmp12 = (d0 - d4) * CONST_SCALE; } } diff --git a/libavcodec/simple_idct_template.c b/libavcodec/simple_idct_template.c index b287c4f6bf..171ae08254 100644 --- a/libavcodec/simple_idct_template.c +++ b/libavcodec/simple_idct_template.c @@ -96,12 +96,12 @@ static inline void FUNC(idctRowCondDC)(int16_t *row, int extra_shift) if (((((uint64_t *)row)[0] & ~ROW0_MASK) | ((uint64_t *)row)[1]) == 0) { uint64_t temp; if (DC_SHIFT - extra_shift > 0) { - temp = (row[0] << (DC_SHIFT - extra_shift)) & 0xffff; + temp = (row[0] * (1 << (DC_SHIFT - extra_shift))) & 0xffff; } else { temp = (row[0] >> (extra_shift - DC_SHIFT)) & 0xffff; } - temp += temp << 16; - temp += temp << 32; + temp += temp * (1 << 16); + temp += temp * ((uint64_t) 1 << 32); ((uint64_t *)row)[0] = temp; ((uint64_t *)row)[1] = temp; return; @@ -113,11 +113,11 @@ static inline void FUNC(idctRowCondDC)(int16_t *row, int extra_shift) row[1])) { uint32_t temp; if (DC_SHIFT - extra_shift > 0) { - temp = (row[0] << (DC_SHIFT - extra_shift)) & 0xffff; + temp = (row[0] * (1 << (DC_SHIFT - extra_shift))) & 0xffff; } else { temp = (row[0] >> (extra_shift - DC_SHIFT)) & 0xffff; } - temp += temp << 16; + temp += temp * (1 << 16); ((uint32_t*)row)[0]=((uint32_t*)row)[1] = ((uint32_t*)row)[2]=((uint32_t*)row)[3] = temp; return;