| Index: chromium/patches/to_upstream/52_vorbis_fix_floor1_vector_int_overflow.patch
|
| diff --git a/chromium/patches/to_upstream/52_vorbis_fix_floor1_vector_int_overflow.patch b/chromium/patches/to_upstream/52_vorbis_fix_floor1_vector_int_overflow.patch
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..5f9c82ecc8f3776d6d0e0b47323e33cfeedadc93
|
| --- /dev/null
|
| +++ b/chromium/patches/to_upstream/52_vorbis_fix_floor1_vector_int_overflow.patch
|
| @@ -0,0 +1,86 @@
|
| +Index: patched-ffmpeg/libavcodec/vorbisdec.c
|
| +===================================================================
|
| +--- patched-ffmpeg/libavcodec/vorbisdec.c (revision 112050)
|
| ++++ patched-ffmpeg/libavcodec/vorbisdec.c (working copy)
|
| +@@ -1234,20 +1234,20 @@
|
| + floor1_flag[i] = 1;
|
| + if (val >= room) {
|
| + if (highroom > lowroom) {
|
| +- floor1_Y_final[i] = val - lowroom + predicted;
|
| ++ floor1_Y_final[i] = av_clip_uint16(val - lowroom + predicted);
|
| + } else {
|
| +- floor1_Y_final[i] = predicted - val + highroom - 1;
|
| ++ floor1_Y_final[i] = av_clip_uint16(predicted - val + highroom - 1);
|
| + }
|
| + } else {
|
| + if (val & 1) {
|
| +- floor1_Y_final[i] = predicted - (val + 1) / 2;
|
| ++ floor1_Y_final[i] = av_clip_uint16(predicted - (val + 1) / 2);
|
| + } else {
|
| +- floor1_Y_final[i] = predicted + val / 2;
|
| ++ floor1_Y_final[i] = av_clip_uint16(predicted + val / 2);
|
| + }
|
| + }
|
| + } else {
|
| + floor1_flag[i] = 0;
|
| +- floor1_Y_final[i] = predicted;
|
| ++ floor1_Y_final[i] = av_clip_uint16(predicted);
|
| + }
|
| +
|
| + av_dlog(NULL, " Decoded floor(%d) = %u / val %u\n",
|
| +Index: patched-ffmpeg/libavcodec/vorbis.c
|
| +===================================================================
|
| +--- patched-ffmpeg/libavcodec/vorbis.c (revision 112050)
|
| ++++ patched-ffmpeg/libavcodec/vorbis.c (working copy)
|
| +@@ -150,7 +150,7 @@
|
| + }
|
| + }
|
| +
|
| +-static inline void render_line_unrolled(intptr_t x, unsigned char y, int x1,
|
| ++static inline void render_line_unrolled(intptr_t x, int y, int x1,
|
| + intptr_t sy, int ady, int adx,
|
| + float *buf)
|
| + {
|
| +@@ -162,14 +162,14 @@
|
| + if (err >= 0) {
|
| + err += ady - adx;
|
| + y += sy;
|
| +- buf[x++] = ff_vorbis_floor1_inverse_db_table[y];
|
| ++ buf[x++] = ff_vorbis_floor1_inverse_db_table[av_clip_uint8(y)];
|
| + }
|
| +- buf[x] = ff_vorbis_floor1_inverse_db_table[y];
|
| ++ buf[x] = ff_vorbis_floor1_inverse_db_table[av_clip_uint8(y)];
|
| + }
|
| + if (x <= 0) {
|
| + if (err + ady >= 0)
|
| + y += sy;
|
| +- buf[x] = ff_vorbis_floor1_inverse_db_table[y];
|
| ++ buf[x] = ff_vorbis_floor1_inverse_db_table[av_clip_uint8(y)];
|
| + }
|
| + }
|
| +
|
| +@@ -179,13 +179,13 @@
|
| + int adx = x1 - x0;
|
| + int ady = FFABS(dy);
|
| + int sy = dy < 0 ? -1 : 1;
|
| +- buf[x0] = ff_vorbis_floor1_inverse_db_table[y0];
|
| ++ buf[x0] = ff_vorbis_floor1_inverse_db_table[av_clip_uint8(y0)];
|
| + if (ady*2 <= adx) { // optimized common case
|
| + render_line_unrolled(x0, y0, x1, sy, ady, adx, buf);
|
| + } else {
|
| + int base = dy / adx;
|
| + int x = x0;
|
| +- unsigned char y = y0;
|
| ++ int y = y0;
|
| + int err = -adx;
|
| + ady -= FFABS(base) * adx;
|
| + while (++x < x1) {
|
| +@@ -195,7 +195,7 @@
|
| + err -= adx;
|
| + y += sy;
|
| + }
|
| +- buf[x] = ff_vorbis_floor1_inverse_db_table[y];
|
| ++ buf[x] = ff_vorbis_floor1_inverse_db_table[av_clip_uint8(y)];
|
| + }
|
| + }
|
| + }
|
|
|