[vlc-commits] [Git][videolan/vlc][3.0.x] 2 commits: contrib: mpc: fix undefined behavior on negative shift
Steve Lhomme (@robUx4)
gitlab at videolan.org
Wed Jul 29 09:10:24 UTC 2026
Steve Lhomme pushed to branch 3.0.x at VideoLAN / VLC
Commits:
34c389e8 by Steve Lhomme at 2026-07-29T07:56:24+00:00
contrib: mpc: fix undefined behavior on negative shift
Fixes #29807
- - - - -
8f785946 by Steve Lhomme at 2026-07-29T07:56:24+00:00
contrib: mpc: fix bogus access to global variable
No regression with the samples that work with VLC 3 in https://streams.videolan.org/streams/mpc/
Fixes #29808
- - - - -
3 changed files:
- + contrib/src/mpcdec/0008-mpc_demux-avoid-using-a-shift-on-negative-value.patch
- + contrib/src/mpcdec/0009-mpc_decoder-add-sanity-checks-on-the-Cc-access.patch
- contrib/src/mpcdec/rules.mak
Changes:
=====================================
contrib/src/mpcdec/0008-mpc_demux-avoid-using-a-shift-on-negative-value.patch
=====================================
@@ -0,0 +1,54 @@
+From b250b43cfa8ee3b7cf9bf1d7d613aa4e69b54de5 Mon Sep 17 00:00:00 2001
+From: Steve Lhomme <robux4 at ycbcr.xyz>
+Date: Fri, 24 Apr 2026 09:10:11 +0200
+Subject: [PATCH 8/8] mpc_demux: avoid using a shift on negative value
+
+This is undefined behavior.
+Just use the actual value as a uint32_t constant as it's used on uint32_t values.
+---
+ libmpcdec/mpc_demux.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/libmpcdec/mpc_demux.c b/libmpcdec/mpc_demux.c
+index c28a9a0..14e312c 100644
+--- a/libmpcdec/mpc_demux.c
++++ b/libmpcdec/mpc_demux.c
+@@ -34,6 +34,7 @@
+
+ #include <math.h>
+ #include <string.h>
++#include <stdint.h>
+ #include <mpc/streaminfo.h>
+ #include <mpc/mpcdec.h>
+ #include <mpc/minimax.h>
+@@ -78,6 +79,7 @@ static mpc_int32_t mpc_unread_bytes_unchecked(mpc_demux * d) {
+ return d->bytes_total + d->buffer - d->bits_reader.buff - ((8 - d->bits_reader.count) >> 3);
+ }
+
++#define BUFFER_SWAP_MASK UINT32_C(0xFFFFFFFC)
+
+ // Returns the number of bytes available in the buffer.
+ static mpc_uint32_t
+@@ -99,8 +101,8 @@ mpc_demux_fill(mpc_demux * d, mpc_uint32_t min_bytes, int flags)
+ mpc_uint32_t bytesread;
+
+ if (flags & MPC_BUFFER_SWAP) {
+- bytes2read &= -1 << 2;
+- offset = (unread_bytes + 3) & ( -1 << 2);
++ bytes2read &= BUFFER_SWAP_MASK;
++ offset = (unread_bytes + 3) & ( BUFFER_SWAP_MASK);
+ offset -= unread_bytes;
+ }
+
+@@ -152,7 +154,7 @@ mpc_demux_seek(mpc_demux * d, mpc_seek_t fpos, mpc_uint32_t min_bytes) {
+ } else {
+ mpc_seek_t next_pos = fpos >> 3;
+ if (d->si.stream_version == 7)
+- next_pos = ((next_pos - d->si.header_position) & (-1 << 2)) + d->si.header_position;
++ next_pos = ((next_pos - d->si.header_position) & (BUFFER_SWAP_MASK)) + d->si.header_position;
+ bit_offset = (int) (fpos - (next_pos << 3));
+
+ mpc_demux_clear_buff(d);
+--
+2.52.0.windows.1
+
=====================================
contrib/src/mpcdec/0009-mpc_decoder-add-sanity-checks-on-the-Cc-access.patch
=====================================
@@ -0,0 +1,57 @@
+From 7141ac9dcc07ed59c663404bd8473c1ac4170a2d Mon Sep 17 00:00:00 2001
+From: Steve Lhomme <robux4 at ycbcr.xyz>
+Date: Fri, 24 Apr 2026 10:35:21 +0200
+Subject: [PATCH 9/9] mpc_decoder: add sanity checks on the Cc access
+
+Cc is __Cc shifted by one value. It has 1+18 values.
+---
+ libmpcdec/mpc_decoder.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/libmpcdec/mpc_decoder.c b/libmpcdec/mpc_decoder.c
+index 5f56c00..022062a 100644
+--- a/libmpcdec/mpc_decoder.c
++++ b/libmpcdec/mpc_decoder.c
+@@ -220,8 +220,8 @@ mpc_decoder_requantisierung(mpc_decoder *d)
+ R = d->Q[Band].R;
+ /************************** MS-coded **************************/
+ if ( d->MS_Flag [Band] ) {
+- if ( d->Res_L [Band] ) {
+- if ( d->Res_R [Band] ) { // M!=0, S!=0
++ if ( d->Res_L [Band] == -1 || ( d->Res_L [Band] > 0 && d->Res_L [Band] < 18 ) ) {
++ if ( d->Res_R [Band] == -1 || ( d->Res_R [Band] > 0 && d->Res_R [Band] < 18 ) ) { // M!=0, S!=0
+ facL = MPC_MULTIPLY_SCF( Cc[d->Res_L[Band]] , d->SCF_Index_L[Band][0] & 0xFF);
+ facR = MPC_MULTIPLY_SCF( Cc[d->Res_R[Band]] , d->SCF_Index_R[Band][0] & 0xFF);
+ for ( n = 0; n < 12; n++, YL += 32, YR += 32 ) {
+@@ -255,7 +255,7 @@ mpc_decoder_requantisierung(mpc_decoder *d)
+ }
+ }
+ } else {
+- if (d->Res_R[Band]) // M==0, S!=0
++ if ( d->Res_R[Band] == -1 || ( d->Res_R[Band] > 0 && d->Res_R[Band] < 18 ) ) // M==0, S!=0
+ {
+ facR = MPC_MULTIPLY_SCF( Cc[d->Res_R[Band]] , d->SCF_Index_R[Band][0] & 0xFF);
+ for ( n = 0; n < 12; n++, YL += 32, YR += 32 ) {
+@@ -278,8 +278,8 @@ mpc_decoder_requantisierung(mpc_decoder *d)
+ }
+ /************************** LR-coded **************************/
+ else {
+- if ( d->Res_L [Band] ) {
+- if ( d->Res_R [Band] ) { // L!=0, R!=0
++ if ( d->Res_L [Band] == -1 || ( d->Res_L [Band] > 0 && d->Res_L [Band] < 18 ) ) {
++ if ( d->Res_R [Band] == -1 || ( d->Res_R [Band] > 0 && d->Res_R [Band] < 18 ) ) { // L!=0, R!=0
+ facL = MPC_MULTIPLY_SCF( Cc[d->Res_L[Band]] , d->SCF_Index_L[Band][0] & 0xFF);
+ facR = MPC_MULTIPLY_SCF( Cc[d->Res_R[Band]] , d->SCF_Index_R[Band][0] & 0xFF);
+ for (n = 0; n < 12; n++, YL += 32, YR += 32 ) {
+@@ -317,7 +317,7 @@ mpc_decoder_requantisierung(mpc_decoder *d)
+ }
+ }
+ else {
+- if ( d->Res_R [Band] ) { // L==0, R!=0
++ if ( d->Res_R [Band] == -1 || ( d->Res_R [Band] > 0 && d->Res_R [Band] < 18 ) ) { // L==0, R!=0
+ facR = MPC_MULTIPLY_SCF( Cc[d->Res_R[Band]] , d->SCF_Index_R[Band][0] & 0xFF);
+ for ( n = 0; n < 12; n++, YL += 32, YR += 32 ) {
+ *YL = 0;
+--
+2.52.0.windows.1
+
=====================================
contrib/src/mpcdec/rules.mak
=====================================
@@ -26,6 +26,8 @@ musepack: musepack_src_r$(MUSE_REV).tar.gz .sum-mpcdec
$(APPLY) $(SRC)/mpcdec/0005-If-BUILD_SHARED_LIBS-is-set-and-SHARED-undefined-the.patch
$(APPLY) $(SRC)/mpcdec/0006-adapted-patch-0001-shared.patch-from-buildroot.patch
$(APPLY) $(SRC)/mpcdec/0007-only-build-libmpcdec.patch
+ $(APPLY) $(SRC)/mpcdec/0008-mpc_demux-avoid-using-a-shift-on-negative-value.patch
+ $(APPLY) $(SRC)/mpcdec/0009-mpc_decoder-add-sanity-checks-on-the-Cc-access.patch
$(MOVE)
.mpcdec: musepack toolchain.cmake
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/44cc9963f78c7fd032f68d705dacc4feca919a60...8f785946baf93824d15c8871a65de2f38346e260
--
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/44cc9963f78c7fd032f68d705dacc4feca919a60...8f785946baf93824d15c8871a65de2f38346e260
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help
More information about the vlc-commits
mailing list