diff options
| author | Rémi Denis-Courmont <remi@remlab.net> | 2024-06-27 22:00:05 +0300 |
|---|---|---|
| committer | Rémi Denis-Courmont <remi@remlab.net> | 2024-06-30 19:02:32 +0300 |
| commit | b818dff8d8e16f0831a379a5cdc15e813474a841 (patch) | |
| tree | 66ed67a96d8157733c08aa779fbf54a577847a5c /libavcodec | |
| parent | 349c49fd1bc5ae2d81ea8d93e0b31823fe8b2c59 (diff) | |
| download | ffmpeg-b818dff8d8e16f0831a379a5cdc15e813474a841.tar.gz | |
lavc/vc1dsp: fix potential overflow in R-V V inv_trans_4
Judging by the coefficients, the last round of add/sub can overflow
to 17 bits with a very small probability just as with the 8-point
transform. This is not observed under FATE, but better safe than sorry.
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/riscv/vc1dsp_rvv.S | 15 |
1 files changed, 8 insertions, 7 deletions
diff --git a/libavcodec/riscv/vc1dsp_rvv.S b/libavcodec/riscv/vc1dsp_rvv.S index 0e89e29a1d..9d85377cec 100644 --- a/libavcodec/riscv/vc1dsp_rvv.S +++ b/libavcodec/riscv/vc1dsp_rvv.S @@ -202,13 +202,14 @@ func ff_vc1_inv_trans_4_rvv, zve32x vmul.vx v20, v1, t2 vadd.vv v26, v14, v16 # t3 vsub.vv v27, v18, v20 # t4 - vadd.vv v0, v24, v26 - vsub.vv v1, v25, v27 - vadd.vv v2, v25, v27 - vsub.vv v3, v24, v26 - .irp n,0,1,2,3 - vssra.vx v\n, v\n, t1 # + 4 >> 3 or + 64 >> 7 - .endr + vwadd.vv v8, v24, v26 + vwsub.vv v10, v25, v27 + vwadd.vv v12, v25, v27 + vwsub.vv v14, v24, v26 + vnclip.wx v0, v8, t1 + vnclip.wx v1, v10, t1 + vnclip.wx v2, v12, t1 + vnclip.wx v3, v14, t1 jr t0 endfunc |