commit 7e49387709be9aa3bbd4bcfc14f74d87a8c106d7
author Jerome Jiang <jianj@google.com> Mon Mar 26 17:48:24 2018 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Fri Jul 20 00:25:58 2018 +0000
tree fe99aa97cf716403c59a8b5cf5773c48894c6d8f
parent 3946515770a0dfb12825602aba678b72636c609b

DO NOT MERGE | libvpx: cherry pick fix to OOB of mv_cost index.

Bug: b/72510002
Test: poc provided in the bug.
Change-Id: I011763cd35b3bac1621e19e4447c442a39d66011
(cherry picked from commit 073990fb32f39c64e4ba9cbd5fb11bfc0c1f0aad)

libvpx/vp8/encoder/mcomp.c

diff --git a/libvpx/vp8/encoder/mcomp.c b/libvpx/vp8/encoder/mcomp.c
index 970120f..b4a49a3 100644
--- a/libvpx/vp8/encoder/mcomp.c
+++ b/libvpx/vp8/encoder/mcomp.c
@@ -34,19 +34,22 @@
    * NEAREST for subsequent blocks. The "Weight" parameter allows, to a
    * limited extent, for some account to be taken of these factors.
    */
-  return ((mvcost[0][(mv->as_mv.row - ref->as_mv.row) >> 1] +
-           mvcost[1][(mv->as_mv.col - ref->as_mv.col) >> 1]) *
-          Weight) >>
-         7;
+  const int mv_idx_row =
+      clamp((mv->as_mv.row - ref->as_mv.row) >> 1, 0, MVvals);
+  const int mv_idx_col =
+      clamp((mv->as_mv.col - ref->as_mv.col) >> 1, 0, MVvals);
+  return ((mvcost[0][mv_idx_row] + mvcost[1][mv_idx_col]) * Weight) >> 7;
 }
 
 static int mv_err_cost(int_mv *mv, int_mv *ref, int *mvcost[2],
                        int error_per_bit) {
   /* Ignore mv costing if mvcost is NULL */
   if (mvcost) {
-    return ((mvcost[0][(mv->as_mv.row - ref->as_mv.row) >> 1] +
-             mvcost[1][(mv->as_mv.col - ref->as_mv.col) >> 1]) *
-                error_per_bit +
+    const int mv_idx_row =
+        clamp((mv->as_mv.row - ref->as_mv.row) >> 1, 0, MVvals);
+    const int mv_idx_col =
+        clamp((mv->as_mv.col - ref->as_mv.col) >> 1, 0, MVvals);
+    return ((mvcost[0][mv_idx_row] + mvcost[1][mv_idx_col]) * error_per_bit +
             128) >>
            8;
   }