From d008a00335bf8874109b031d53606e6dd9cb88e4 Mon Sep 17 00:00:00 2001 From: Joose Sainio Date: Mon, 1 Jul 2024 12:37:53 +0300 Subject: [PATCH] [dep-quant] Fix read out of bounds and left shift of negative --- src/dep_quant.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/dep_quant.c b/src/dep_quant.c index 16591390..75127546 100644 --- a/src/dep_quant.c +++ b/src/dep_quant.c @@ -573,8 +573,8 @@ static INLINE void update_common_context( uint8_t* sbbFlags = cc->m_allSbbCtx[cc->m_curr_sbb_ctx_offset].sbbFlags; uint8_t* levels = cc->m_allSbbCtx[cc->m_curr_sbb_ctx_offset].levels; size_t setCpSize = cc->m_nbInfo[scan_pos - 1].maxDist * sizeof(uint8_t); - int8_t prev_sbb_state = ctxs->m_allStates.m_refSbbCtxId[prev_state]; - if (prev_state != -1 && prev_sbb_state >= 0) { + if (prev_state != -1) { + const int8_t prev_sbb_state = ctxs->m_allStates.m_refSbbCtxId[prev_state]; for (int i = 0; i < numSbb; ++i) { sbbFlags[i * 4 + curr_state_without_offset] = cc->m_allSbbCtx[cc->m_prev_sbb_ctx_offset].sbbFlags[i * 4 + prev_sbb_state]; } @@ -1130,7 +1130,7 @@ void uvg_dep_quant_dequant( { invQScale <<= -shift; } - int qIdx = (level << 1) + (level > 0 ? -(state >> 1) : (state >> 1)); + int qIdx = (level * 2) + (level > 0 ? -(state >> 1) : (state >> 1)); int64_t nomTCoeff = ((int64_t)qIdx * (int64_t)invQScale + add) >> ((shift < 0) ? 0 : shift); coeff[rasterPos] = (coeff_t)CLIP(minTCoeff, maxTCoeff, nomTCoeff); }