Commit a2bda884 authored by Janne Grunau's avatar Janne Grunau

intrabc: adjust right border to multiple of the block size

This fixes an overlapping memcpy with
clusterfuzz-testcase-minimized-dav1d_fuzzer_mt-5734069753610240. This is
a regression introduced by "intrabc: use visible width/height in mv
correction".

This reverts commit 7677c120.
parent cd57a9a0
Pipeline #3704 passed with stages
in 5 minutes and 9 seconds
......@@ -1264,16 +1264,17 @@ static int decode_b(Dav1dTileContext *const t,
}
int src_left = t->bx * 4 + (b->mv[0].x >> 3);
int src_top = t->by * 4 + (b->mv[0].y >> 3);
int src_right = src_left + w4 * 4;
int src_bottom = src_top + h4 * 4;
int src_right = src_left + bw4 * 4;
int src_bottom = src_top + bh4 * 4;
const int border_right = ((ts->tiling.col_end + (bw4 - 1)) & ~(bw4 - 1)) * 4;
// check against left or right tile boundary and adjust if necessary
if (src_left < border_left) {
src_right += border_left - src_left;
src_left += border_left - src_left;
} else if (src_right > ts->tiling.col_end * 4) {
src_left -= src_right - ts->tiling.col_end * 4;
src_right -= src_right - ts->tiling.col_end * 4;
} else if (src_right > border_right) {
src_left -= src_right - border_right;
src_right -= src_right - border_right;
}
// check against top tile boundary and adjust if necessary
if (src_top < border_top) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment