Bug 625773 - uninitialised value use in FastConvertYUVToRGB32Row; r=cpearce a=roc
authorTimothy B. Terriberry <tterribe@vt.edu>
Mon, 17 Jan 2011 12:18:34 -0500
changeset 60702 14f62a4633a631890e4b54e787f70cb1d0fe5893
parent 60701 c22c9543a44959b24069d44dcb8dfb41e360c1c9
child 60703 d7930adbeb1a32d0b1ee791deaf206415703855d
push id18085
push usereakhgari@mozilla.com
push dateMon, 17 Jan 2011 17:37:37 +0000
treeherdermozilla-central@0b2511671608 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerscpearce, roc
bugs625773
milestone2.0b10pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 625773 - uninitialised value use in FastConvertYUVToRGB32Row; r=cpearce a=roc
media/libtheora/bug625773-r17780.patch
media/libtheora/lib/decode.c
media/libtheora/update.sh
new file mode 100644
--- /dev/null
+++ b/media/libtheora/bug625773-r17780.patch
@@ -0,0 +1,23 @@
+diff --git a/media/libtheora/lib/decode.c b/media/libtheora/lib/decode.c
+--- a/media/libtheora/lib/decode.c
++++ b/media/libtheora/lib/decode.c
+@@ -2072,18 +2072,17 @@ static void oc_dec_init_dummy_frame(th_d
+    sizeof(_dec->pp_frame_buf[0])*3);
+   info=&_dec->state.info;
+   yhstride=abs(_dec->state.ref_ystride[0]);
+   yheight=info->frame_height+2*OC_UMV_PADDING;
+   chstride=abs(_dec->state.ref_ystride[1]);
+   cheight=yheight>>!(info->pixel_fmt&2);
+   yplane_sz=yhstride*(size_t)yheight+16;
+   cplane_sz=chstride*(size_t)cheight;
+-  yoffset=_dec->state.ref_ystride[0]*(yheight-1)-
+-   (OC_UMV_PADDING+OC_UMV_PADDING*(ptrdiff_t)yhstride);
++  yoffset=yhstride*(ptrdiff_t)(yheight-OC_UMV_PADDING-1)+OC_UMV_PADDING;
+   memset(_dec->state.ref_frame_data[0]-yoffset,0x80,yplane_sz+2*cplane_sz);
+ }
+ 
+ int th_decode_packetin(th_dec_ctx *_dec,const ogg_packet *_op,
+  ogg_int64_t *_granpos){
+   int ret;
+   if(_dec==NULL||_op==NULL)return TH_EFAULT;
+   /*A completely empty packet indicates a dropped frame and is treated exactly
--- a/media/libtheora/lib/decode.c
+++ b/media/libtheora/lib/decode.c
@@ -2072,18 +2072,17 @@ static void oc_dec_init_dummy_frame(th_d
    sizeof(_dec->pp_frame_buf[0])*3);
   info=&_dec->state.info;
   yhstride=abs(_dec->state.ref_ystride[0]);
   yheight=info->frame_height+2*OC_UMV_PADDING;
   chstride=abs(_dec->state.ref_ystride[1]);
   cheight=yheight>>!(info->pixel_fmt&2);
   yplane_sz=yhstride*(size_t)yheight+16;
   cplane_sz=chstride*(size_t)cheight;
-  yoffset=_dec->state.ref_ystride[0]*(yheight-1)-
-   (OC_UMV_PADDING+OC_UMV_PADDING*(ptrdiff_t)yhstride);
+  yoffset=yhstride*(ptrdiff_t)(yheight-OC_UMV_PADDING-1)+OC_UMV_PADDING;
   memset(_dec->state.ref_frame_data[0]-yoffset,0x80,yplane_sz+2*cplane_sz);
 }
 
 int th_decode_packetin(th_dec_ctx *_dec,const ogg_packet *_op,
  ogg_int64_t *_granpos){
   int ret;
   if(_dec==NULL||_op==NULL)return TH_EFAULT;
   /*A completely empty packet indicates a dropped frame and is treated exactly
old mode 100644
new mode 100755
--- a/media/libtheora/update.sh
+++ b/media/libtheora/update.sh
@@ -73,8 +73,9 @@ cp $1/lib/x86_vc/mmxstate.c ./lib/x86_vc
 cp $1/lib/x86_vc/x86cpu.c ./lib/x86_vc/
 cp $1/lib/x86_vc/x86cpu.h ./lib/x86_vc/
 cp $1/lib/x86_vc/x86int.h ./lib/x86_vc/
 cp $1/lib/x86_vc/x86state.c ./lib/x86_vc/
 cp $1/include/theora/theora.h ./include/theora/theora.h
 cp $1/include/theora/theoradec.h ./include/theora/theoradec.h
 cp $1/include/theora/theoraenc.h ./include/theora/theoraenc.h
 cp $1/include/theora/codec.h ./include/theora/codec.h
+patch -p3 < ./bug625773-r17780.patch