From aee9aa92161f9e5eb385277b47ddc273e7a62133 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 5 Jan 2016 01:06:18 +0100 Subject: [PATCH] avcodec/h264_slice: Fix integer overflow in implicit weight computation Fixes mozilla bug 1230423 Signed-off-by: Michael Niedermayer (cherry picked from commit 7cc01c25727a96eaaa0c177234b626e47c8ea491) Signed-off-by: Michael Niedermayer --- libavcodec/h264_slice.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/h264_slice.c b/libavcodec/h264_slice.c index 8be803b7fd..63eb463e8e 100644 --- a/libavcodec/h264_slice.c +++ b/libavcodec/h264_slice.c @@ -783,7 +783,7 @@ static void implicit_weight_table(const H264Context *h, H264SliceContext *sl, in cur_poc = h->cur_pic_ptr->field_poc[h->picture_structure - 1]; } if (sl->ref_count[0] == 1 && sl->ref_count[1] == 1 && !FRAME_MBAFF(h) && - sl->ref_list[0][0].poc + sl->ref_list[1][0].poc == 2 * cur_poc) { + sl->ref_list[0][0].poc + (int64_t)sl->ref_list[1][0].poc == 2 * cur_poc) { sl->use_weight = 0; sl->use_weight_chroma = 0; return; @@ -804,7 +804,7 @@ static void implicit_weight_table(const H264Context *h, H264SliceContext *sl, in sl->chroma_log2_weight_denom = 5; for (ref0 = ref_start; ref0 < ref_count0; ref0++) { - int poc0 = sl->ref_list[0][ref0].poc; + int64_t poc0 = sl->ref_list[0][ref0].poc; for (ref1 = ref_start; ref1 < ref_count1; ref1++) { int w = 32; if (!sl->ref_list[0][ref0].parent->long_ref && !sl->ref_list[1][ref1].parent->long_ref) {