From 5b14f436c6358dc0db599be6a1c635a4135a96a9 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 5 Jan 2016 01:06:18 +0100
Subject: [PATCH] avcodec/h264_slice: Fix integer overflow in implicit weight
computation
Fixes mozilla bug 1230423
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7cc01c25727a96eaaa0c177234b626e47c8ea491)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/h264_slice.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/h264_slice.c b/libavcodec/h264_slice.c
index f80c469986..75ea464b8d 100644
--- a/libavcodec/h264_slice.c
+++ b/libavcodec/h264_slice.c
@@ -778,7 +778,7 @@ static void implicit_weight_table(const H264Context *h, H264SliceContext *sl, in
cur_poc = h->cur_pic_ptr->field_poc[h->picture_structure - 1];
}
if (sl->ref_count[0] == 1 && sl->ref_count[1] == 1 && !FRAME_MBAFF(h) &&
- sl->ref_list[0][0].poc + sl->ref_list[1][0].poc == 2 * cur_poc) {
+ sl->ref_list[0][0].poc + (int64_t)sl->ref_list[1][0].poc == 2 * cur_poc) {
sl->use_weight = 0;
sl->use_weight_chroma = 0;
return;
@@ -799,7 +799,7 @@ static void implicit_weight_table(const H264Context *h, H264SliceContext *sl, in
sl->chroma_log2_weight_denom = 5;
for (ref0 = ref_start; ref0 < ref_count0; ref0++) {
- int poc0 = sl->ref_list[0][ref0].poc;
+ int64_t poc0 = sl->ref_list[0][ref0].poc;
for (ref1 = ref_start; ref1 < ref_count1; ref1++) {
int w = 32;
if (!sl->ref_list[0][ref0].parent->long_ref && !sl->ref_list[1][ref1].parent->long_ref) {