avcodec/h264_slice: Fix integer overflow in implicit weight computation
authorMichael Niedermayer <michael@niedermayer.cc>
Tue, 5 Jan 2016 00:06:18 +0000 (01:06 +0100)
committerMichael Niedermayer <michael@niedermayer.cc>
Fri, 15 Jan 2016 16:39:04 +0000 (17:39 +0100)
Fixes mozilla bug 1230423

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7cc01c25727a96eaaa0c177234b626e47c8ea491)

Conflicts:

libavcodec/h264_slice.c

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/h264_slice.c

index 57a135e..b24978a 100644 (file)
@@ -924,7 +924,7 @@ static void implicit_weight_table(H264Context *h, int field)
             cur_poc = h->cur_pic_ptr->field_poc[h->picture_structure - 1];
         }
         if (h->ref_count[0] == 1 && h->ref_count[1] == 1 && !FRAME_MBAFF(h) &&
-            h->ref_list[0][0].poc + h->ref_list[1][0].poc == 2 * cur_poc) {
+            h->ref_list[0][0].poc + (int64_t)h->ref_list[1][0].poc == 2 * cur_poc) {
             h->use_weight        = 0;
             h->use_weight_chroma = 0;
             return;
@@ -945,7 +945,7 @@ static void implicit_weight_table(H264Context *h, int field)
     h->chroma_log2_weight_denom = 5;
 
     for (ref0 = ref_start; ref0 < ref_count0; ref0++) {
-        int poc0 = h->ref_list[0][ref0].poc;
+        int64_t poc0 = h->ref_list[0][ref0].poc;
         for (ref1 = ref_start; ref1 < ref_count1; ref1++) {
             int w = 32;
             if (!h->ref_list[0][ref0].long_ref && !h->ref_list[1][ref1].long_ref) {