fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-07 04:58:05 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

frontends/va: Fix parsing leb128 when using more than 4 bytes

Browse source 
Bit shift would go over 32 bits. Also add assert for maximum
value as allowed by spec.

Fixes coverity issue 1469252 Bad bit shift operation

Fixes: 5edbecb856 ("frontends/va: adding va av1 encoding functions")
Acked-by: Leo Liu <leo.liu@amd.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/31622>
(cherry picked from commit 2cb3c2e8d5)
This commit is contained in:
David Rosca 2024-10-14 10:44:28 +02:00 • committed by Eric Engestrom
parent e9884d1624
commit 2f2b79a495
2 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
.pick_status.json
View file

@ -284,7 +284,7 @@
"description": "frontends/va: Fix parsing leb128 when using more than 4 bytes", "description": "frontends/va: Fix parsing leb128 when using more than 4 bytes",
"nominated": true, "nominated": true,
"nomination_type": 1, "nomination_type": 1,
"resolution": 0, "resolution": 1,
"main_sha": null, "main_sha": null,
"because_sha": "5edbecb8569d88e7faa28ca7a56eb5e1672a2dd0", "because_sha": "5edbecb8569d88e7faa28ca7a56eb5e1672a2dd0",
"notes": null "notes": null

5
src/gallium/frontends/va/picture_av1_enc.c
View file

@ -84,17 +84,18 @@ static unsigned av1_uvlc(struct vl_vlc *vlc)
static unsigned av1_uleb128(struct vl_vlc *vlc) static unsigned av1_uleb128(struct vl_vlc *vlc)
{ {
unsigned value = 0; uint64_t value = 0;
unsigned leb128Bytes = 0; unsigned leb128Bytes = 0;
unsigned i; unsigned i;
for (i = 0; i < 8; ++i) { for (i = 0; i < 8; ++i) {
leb128Bytes = av1_f(vlc, 8); leb128Bytes = av1_f(vlc, 8);
value |= ((leb128Bytes & 0x7f) << (i * 7)); value |= ((uint64_t)(leb128Bytes & 0x7f) << (i * 7));
if (!(leb128Bytes & 0x80)) if (!(leb128Bytes & 0x80))
break; break;
} }
assert(value <= UINT32_MAX);
return value; return value;
} }