mirror of
https://github.com/librempeg/librempeg
synced 2024-11-23 19:58:59 +00:00
58cf31cee7
Fixes: out of array read Fixes: 3516/attachment-311488.dat Found-by: Insu Yun, Georgia Tech. Tested-by: wuninsu@gmail.com Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
162 lines
6.1 KiB
C
162 lines
6.1 KiB
C
/*
|
|
* This file is part of FFmpeg.
|
|
*
|
|
* FFmpeg is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation; either
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
*
|
|
* FFmpeg is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with FFmpeg; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
|
*/
|
|
|
|
#include "config.h"
|
|
#include "libavutil/attributes.h"
|
|
#include "libavutil/cpu.h"
|
|
#include "libavutil/x86/cpu.h"
|
|
#include "libavcodec/mpegvideodsp.h"
|
|
#include "libavcodec/videodsp.h"
|
|
|
|
#if HAVE_INLINE_ASM
|
|
|
|
static void gmc_mmx(uint8_t *dst, uint8_t *src,
|
|
int stride, int h, int ox, int oy,
|
|
int dxx, int dxy, int dyx, int dyy,
|
|
int shift, int r, int width, int height)
|
|
{
|
|
const int w = 8;
|
|
const int ix = ox >> (16 + shift);
|
|
const int iy = oy >> (16 + shift);
|
|
const int oxs = ox >> 4;
|
|
const int oys = oy >> 4;
|
|
const int dxxs = dxx >> 4;
|
|
const int dxys = dxy >> 4;
|
|
const int dyxs = dyx >> 4;
|
|
const int dyys = dyy >> 4;
|
|
const uint16_t r4[4] = { r, r, r, r };
|
|
const uint16_t dxy4[4] = { dxys, dxys, dxys, dxys };
|
|
const uint16_t dyy4[4] = { dyys, dyys, dyys, dyys };
|
|
const uint64_t shift2 = 2 * shift;
|
|
#define MAX_STRIDE 4096U
|
|
#define MAX_H 8U
|
|
uint8_t edge_buf[(MAX_H + 1) * MAX_STRIDE];
|
|
int x, y;
|
|
|
|
const int dxw = (dxx - (1 << (16 + shift))) * (w - 1);
|
|
const int dyh = (dyy - (1 << (16 + shift))) * (h - 1);
|
|
const int dxh = dxy * (h - 1);
|
|
const int dyw = dyx * (w - 1);
|
|
int need_emu = (unsigned) ix >= width - w || width < w ||
|
|
(unsigned) iy >= height - h || height< h
|
|
;
|
|
|
|
if ( // non-constant fullpel offset (3% of blocks)
|
|
((ox ^ (ox + dxw)) | (ox ^ (ox + dxh)) | (ox ^ (ox + dxw + dxh)) |
|
|
(oy ^ (oy + dyw)) | (oy ^ (oy + dyh)) | (oy ^ (oy + dyw + dyh))) >> (16 + shift) ||
|
|
// uses more than 16 bits of subpel mv (only at huge resolution)
|
|
(dxx | dxy | dyx | dyy) & 15 ||
|
|
(need_emu && (h > MAX_H || stride > MAX_STRIDE))) {
|
|
// FIXME could still use mmx for some of the rows
|
|
ff_gmc_c(dst, src, stride, h, ox, oy, dxx, dxy, dyx, dyy,
|
|
shift, r, width, height);
|
|
return;
|
|
}
|
|
|
|
src += ix + iy * stride;
|
|
if (need_emu) {
|
|
ff_emulated_edge_mc_8(edge_buf, src, stride, stride, w + 1, h + 1, ix, iy, width, height);
|
|
src = edge_buf;
|
|
}
|
|
|
|
__asm__ volatile (
|
|
"movd %0, %%mm6 \n\t"
|
|
"pxor %%mm7, %%mm7 \n\t"
|
|
"punpcklwd %%mm6, %%mm6 \n\t"
|
|
"punpcklwd %%mm6, %%mm6 \n\t"
|
|
:: "r" (1 << shift));
|
|
|
|
for (x = 0; x < w; x += 4) {
|
|
uint16_t dx4[4] = { oxs - dxys + dxxs * (x + 0),
|
|
oxs - dxys + dxxs * (x + 1),
|
|
oxs - dxys + dxxs * (x + 2),
|
|
oxs - dxys + dxxs * (x + 3) };
|
|
uint16_t dy4[4] = { oys - dyys + dyxs * (x + 0),
|
|
oys - dyys + dyxs * (x + 1),
|
|
oys - dyys + dyxs * (x + 2),
|
|
oys - dyys + dyxs * (x + 3) };
|
|
|
|
for (y = 0; y < h; y++) {
|
|
__asm__ volatile (
|
|
"movq %0, %%mm4 \n\t"
|
|
"movq %1, %%mm5 \n\t"
|
|
"paddw %2, %%mm4 \n\t"
|
|
"paddw %3, %%mm5 \n\t"
|
|
"movq %%mm4, %0 \n\t"
|
|
"movq %%mm5, %1 \n\t"
|
|
"psrlw $12, %%mm4 \n\t"
|
|
"psrlw $12, %%mm5 \n\t"
|
|
: "+m" (*dx4), "+m" (*dy4)
|
|
: "m" (*dxy4), "m" (*dyy4));
|
|
|
|
__asm__ volatile (
|
|
"movq %%mm6, %%mm2 \n\t"
|
|
"movq %%mm6, %%mm1 \n\t"
|
|
"psubw %%mm4, %%mm2 \n\t"
|
|
"psubw %%mm5, %%mm1 \n\t"
|
|
"movq %%mm2, %%mm0 \n\t"
|
|
"movq %%mm4, %%mm3 \n\t"
|
|
"pmullw %%mm1, %%mm0 \n\t" // (s - dx) * (s - dy)
|
|
"pmullw %%mm5, %%mm3 \n\t" // dx * dy
|
|
"pmullw %%mm5, %%mm2 \n\t" // (s - dx) * dy
|
|
"pmullw %%mm4, %%mm1 \n\t" // dx * (s - dy)
|
|
|
|
"movd %4, %%mm5 \n\t"
|
|
"movd %3, %%mm4 \n\t"
|
|
"punpcklbw %%mm7, %%mm5 \n\t"
|
|
"punpcklbw %%mm7, %%mm4 \n\t"
|
|
"pmullw %%mm5, %%mm3 \n\t" // src[1, 1] * dx * dy
|
|
"pmullw %%mm4, %%mm2 \n\t" // src[0, 1] * (s - dx) * dy
|
|
|
|
"movd %2, %%mm5 \n\t"
|
|
"movd %1, %%mm4 \n\t"
|
|
"punpcklbw %%mm7, %%mm5 \n\t"
|
|
"punpcklbw %%mm7, %%mm4 \n\t"
|
|
"pmullw %%mm5, %%mm1 \n\t" // src[1, 0] * dx * (s - dy)
|
|
"pmullw %%mm4, %%mm0 \n\t" // src[0, 0] * (s - dx) * (s - dy)
|
|
"paddw %5, %%mm1 \n\t"
|
|
"paddw %%mm3, %%mm2 \n\t"
|
|
"paddw %%mm1, %%mm0 \n\t"
|
|
"paddw %%mm2, %%mm0 \n\t"
|
|
|
|
"psrlw %6, %%mm0 \n\t"
|
|
"packuswb %%mm0, %%mm0 \n\t"
|
|
"movd %%mm0, %0 \n\t"
|
|
|
|
: "=m" (dst[x + y * stride])
|
|
: "m" (src[0]), "m" (src[1]),
|
|
"m" (src[stride]), "m" (src[stride + 1]),
|
|
"m" (*r4), "m" (shift2));
|
|
src += stride;
|
|
}
|
|
src += 4 - h * stride;
|
|
}
|
|
}
|
|
|
|
#endif /* HAVE_INLINE_ASM */
|
|
|
|
av_cold void ff_mpegvideodsp_init_x86(MpegVideoDSPContext *c)
|
|
{
|
|
#if HAVE_INLINE_ASM
|
|
int cpu_flags = av_get_cpu_flags();
|
|
|
|
if (INLINE_MMX(cpu_flags))
|
|
c->gmc = gmc_mmx;
|
|
#endif /* HAVE_INLINE_ASM */
|
|
}
|