[x265] [PATCH] motion: fix overflow in mvcost() check failure

[Steve Borho]

On 07/03, Divya Manivannan wrote:
> # HG changeset patch
> # User Divya Manivannan <divya at multicorewareinc.com>
> # Date 1435933202 -19800
> #      Fri Jul 03 19:50:02 2015 +0530
> # Node ID 5a28e41404c776a0f8f81c301cbb7c0426857624
> # Parent  f3571dc7b077e2de084f5118c6f6a9316f40f54a
> motion: fix overflow in mvcost() check failure.
> 
> mvcost() funtion always truncate the value to 16 bits but there is a possiblity
> of overflow in the mvcost() check failure condition given.
> 
> This check can be done in the cost calculation (s_costs) initially andso it is
> removed here.

LGTM

> diff -r f3571dc7b077 -r 5a28e41404c7 source/encoder/motion.cpp
> --- a/source/encoder/motion.cpp	Wed Jul 01 14:36:18 2015 +0530
> +++ b/source/encoder/motion.cpp	Fri Jul 03 19:50:02 2015 +0530
> @@ -234,14 +234,9 @@
>                 pix_base + (m1x) + (m1y) * stride, \
>                 pix_base + (m2x) + (m2y) * stride, \
>                 stride, costs); \
> -        const uint16_t *base_mvx = &m_cost_mvx[(bmv.x + (m0x)) << 2]; \
> -        const uint16_t *base_mvy = &m_cost_mvy[(bmv.y + (m0y)) << 2]; \
> -        X265_CHECK(mvcost((bmv + MV(m0x, m0y)) << 2) == (base_mvx[((m0x) - (m0x)) << 2] + base_mvy[((m0y) - (m0y)) << 2]), "mvcost() check failure\n"); \
> -        X265_CHECK(mvcost((bmv + MV(m1x, m1y)) << 2) == (base_mvx[((m1x) - (m0x)) << 2] + base_mvy[((m1y) - (m0y)) << 2]), "mvcost() check failure\n"); \
> -        X265_CHECK(mvcost((bmv + MV(m2x, m2y)) << 2) == (base_mvx[((m2x) - (m0x)) << 2] + base_mvy[((m2y) - (m0y)) << 2]), "mvcost() check failure\n"); \
> -        (costs)[0] += (base_mvx[((m0x) - (m0x)) << 2] + base_mvy[((m0y) - (m0y)) << 2]); \
> -        (costs)[1] += (base_mvx[((m1x) - (m0x)) << 2] + base_mvy[((m1y) - (m0y)) << 2]); \
> -        (costs)[2] += (base_mvx[((m2x) - (m0x)) << 2] + base_mvy[((m2y) - (m0y)) << 2]); \
> +        (costs)[0] += mvcost((bmv + MV(m0x, m0y)) << 2); \
> +        (costs)[1] += mvcost((bmv + MV(m1x, m1y)) << 2); \
> +        (costs)[2] += mvcost((bmv + MV(m2x, m2y)) << 2); \
>      }
>  
>  #define COST_MV_PT_DIST_X4(m0x, m0y, p0, d0, m1x, m1y, p1, d1, m2x, m2y, p2, d2, m3x, m3y, p3, d3) \
> @@ -271,16 +266,10 @@
>                 pix_base + (m2x) + (m2y) * stride, \
>                 pix_base + (m3x) + (m3y) * stride, \
>                 stride, costs); \
> -        const uint16_t *base_mvx = &m_cost_mvx[(omv.x << 2)]; \
> -        const uint16_t *base_mvy = &m_cost_mvy[(omv.y << 2)]; \
> -        X265_CHECK(mvcost((omv + MV(m0x, m0y)) << 2) == (base_mvx[(m0x) << 2] + base_mvy[(m0y) << 2]), "mvcost() check failure\n"); \
> -        X265_CHECK(mvcost((omv + MV(m1x, m1y)) << 2) == (base_mvx[(m1x) << 2] + base_mvy[(m1y) << 2]), "mvcost() check failure\n"); \
> -        X265_CHECK(mvcost((omv + MV(m2x, m2y)) << 2) == (base_mvx[(m2x) << 2] + base_mvy[(m2y) << 2]), "mvcost() check failure\n"); \
> -        X265_CHECK(mvcost((omv + MV(m3x, m3y)) << 2) == (base_mvx[(m3x) << 2] + base_mvy[(m3y) << 2]), "mvcost() check failure\n"); \
> -        costs[0] += (base_mvx[(m0x) << 2] + base_mvy[(m0y) << 2]); \
> -        costs[1] += (base_mvx[(m1x) << 2] + base_mvy[(m1y) << 2]); \
> -        costs[2] += (base_mvx[(m2x) << 2] + base_mvy[(m2y) << 2]); \
> -        costs[3] += (base_mvx[(m3x) << 2] + base_mvy[(m3y) << 2]); \
> +        costs[0] += mvcost((omv + MV(m0x, m0y)) << 2); \
> +        costs[1] += mvcost((omv + MV(m1x, m1y)) << 2); \
> +        costs[2] += mvcost((omv + MV(m2x, m2y)) << 2); \
> +        costs[3] += mvcost((omv + MV(m3x, m3y)) << 2); \
>          COPY2_IF_LT(bcost, costs[0], bmv, omv + MV(m0x, m0y)); \
>          COPY2_IF_LT(bcost, costs[1], bmv, omv + MV(m1x, m1y)); \
>          COPY2_IF_LT(bcost, costs[2], bmv, omv + MV(m2x, m2y)); \
> @@ -296,17 +285,10 @@
>                 pix_base + (m2x) + (m2y) * stride, \
>                 pix_base + (m3x) + (m3y) * stride, \
>                 stride, costs); \
> -        /* TODO: use restrict keyword in ICL */ \
> -        const uint16_t *base_mvx = &m_cost_mvx[(bmv.x << 2)]; \
> -        const uint16_t *base_mvy = &m_cost_mvy[(bmv.y << 2)]; \
> -        X265_CHECK(mvcost((bmv + MV(m0x, m0y)) << 2) == (base_mvx[(m0x) << 2] + base_mvy[(m0y) << 2]), "mvcost() check failure\n"); \
> -        X265_CHECK(mvcost((bmv + MV(m1x, m1y)) << 2) == (base_mvx[(m1x) << 2] + base_mvy[(m1y) << 2]), "mvcost() check failure\n"); \
> -        X265_CHECK(mvcost((bmv + MV(m2x, m2y)) << 2) == (base_mvx[(m2x) << 2] + base_mvy[(m2y) << 2]), "mvcost() check failure\n"); \
> -        X265_CHECK(mvcost((bmv + MV(m3x, m3y)) << 2) == (base_mvx[(m3x) << 2] + base_mvy[(m3y) << 2]), "mvcost() check failure\n"); \
> -        (costs)[0] += (base_mvx[(m0x) << 2] + base_mvy[(m0y) << 2]); \
> -        (costs)[1] += (base_mvx[(m1x) << 2] + base_mvy[(m1y) << 2]); \
> -        (costs)[2] += (base_mvx[(m2x) << 2] + base_mvy[(m2y) << 2]); \
> -        (costs)[3] += (base_mvx[(m3x) << 2] + base_mvy[(m3y) << 2]); \
> +        (costs)[0] += mvcost((bmv + MV(m0x, m0y)) << 2); \
> +        (costs)[1] += mvcost((bmv + MV(m1x, m1y)) << 2); \
> +        (costs)[2] += mvcost((bmv + MV(m2x, m2y)) << 2); \
> +        (costs)[3] += mvcost((bmv + MV(m3x, m3y)) << 2); \
>      }
>  
>  #define DIA1_ITER(mx, my) \
> _______________________________________________
> x265-devel mailing list
> x265-devel at videolan.org
> https://mailman.videolan.org/listinfo/x265-devel

-- 
Steve Borho