Cherry-pick 4c23f1a. rdar://124974991

[dav1d] Fix tile_start_off calculations for extremely large frame sizes https://bugs.webkit.org/show_bug.cgi?id=271068 <rdar://124700924> Unreviewed upstream merge of 2b475307dc11be9a1c3cc4358102c76a7f386a51. * Source/WebCore/PAL/ThirdParty/libavif/ThirdParty/dav1d/src/decode.c: (dav1d_decode_frame_init): * Source/WebCore/PAL/ThirdParty/libavif/ThirdParty/dav1d/src/internal.h: Canonical link: https://commits.webkit.org/276207@main Identifier: 272448.768@safari-7618-branch
WebKit · Mar 20, 2024 · 95db124 · 95db124
1 parent 25dca49
commit 95db124
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 7 deletions.
diff --git a/Source/WebCore/PAL/ThirdParty/libavif/ThirdParty/dav1d/src/decode.c b/Source/WebCore/PAL/ThirdParty/libavif/ThirdParty/dav1d/src/decode.c
@@ -2618,7 +2618,7 @@ static void setup_tile(Dav1dTileState *const ts,
                        const Dav1dFrameContext *const f,
                        const uint8_t *const data, const size_t sz,
                        const int tile_row, const int tile_col,
-                       const int tile_start_off)
+                       const unsigned tile_start_off)
 {
     const int col_sb_start = f->frame_hdr->tiling.col_start_sb[tile_col];
     const int col_sb128_start = col_sb_start >> !f->seq_hdr->sb128;
@@ -2969,15 +2969,16 @@ int dav1d_decode_frame_init(Dav1dFrameContext *const f) {
     const uint8_t *const size_mul = ss_size_mul[f->cur.p.layout];
     const int hbd = !!f->seq_hdr->hbd;
     if (c->n_fc > 1) {
+        const unsigned sb_step4 = f->sb_step * 4;
         int tile_idx = 0;
         for (int tile_row = 0; tile_row < f->frame_hdr->tiling.rows; tile_row++) {
-            int row_off = f->frame_hdr->tiling.row_start_sb[tile_row] *
-                          f->sb_step * 4 * f->sb128w * 128;
-            int b_diff = (f->frame_hdr->tiling.row_start_sb[tile_row + 1] -
-                          f->frame_hdr->tiling.row_start_sb[tile_row]) * f->sb_step * 4;
+            const unsigned row_off = f->frame_hdr->tiling.row_start_sb[tile_row] *
+                                     sb_step4 * f->sb128w * 128;
+            const unsigned b_diff = (f->frame_hdr->tiling.row_start_sb[tile_row + 1] -
+                                     f->frame_hdr->tiling.row_start_sb[tile_row]) * sb_step4;
             for (int tile_col = 0; tile_col < f->frame_hdr->tiling.cols; tile_col++) {
                 f->frame_thread.tile_start_off[tile_idx++] = row_off + b_diff *
-                    f->frame_hdr->tiling.col_start_sb[tile_col] * f->sb_step * 4;
+                    f->frame_hdr->tiling.col_start_sb[tile_col] * sb_step4;
             }
         }
 

diff --git a/Source/WebCore/PAL/ThirdParty/libavif/ThirdParty/dav1d/src/internal.h b/Source/WebCore/PAL/ThirdParty/libavif/ThirdParty/dav1d/src/internal.h
@@ -292,7 +292,7 @@ struct Dav1dFrameContext {
         int prog_sz;
         int pal_sz, pal_idx_sz, cf_sz;
         // start offsets per tile
-        int *tile_start_off;
+        unsigned *tile_start_off;
     } frame_thread;
 
     // loopfilter