Bug Summary

File:root/firefox-clang/media/ffvpx/libavcodec/vlc.c
Warning:line 485, column 19
The right operand of '>' is a garbage value

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -O2 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name vlc.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=all -relaxed-aliasing -ffp-contract=off -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/firefox-clang/obj-x86_64-pc-linux-gnu/media/ffvpx/libavcodec -fcoverage-compilation-dir=/root/firefox-clang/obj-x86_64-pc-linux-gnu/media/ffvpx/libavcodec -resource-dir /usr/lib/llvm-23/lib/clang/23 -include /root/firefox-clang/obj-x86_64-pc-linux-gnu/mozilla-config.h -include libavutil_visibility.h -U _FORTIFY_SOURCE -D _FORTIFY_SOURCE=2 -D DEBUG=1 -D HAVE_AV_CONFIG_H -D ASSERT_LEVEL=2 -I /root/firefox-clang/media/ffvpx/libavcodec -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/media/ffvpx/libavcodec -I /root/firefox-clang/modules/fdlibm/inexact-math-override -I /root/firefox-clang/third_party/khronos/vulkan-headers/include -I /root/firefox-clang/media/mozva -I /root/firefox-clang/media/libopus/include -I /root/firefox-clang/media/libvorbis -I /root/firefox-clang/media/libvpx -I /root/firefox-clang/media/ffvpx -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include/nspr -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include/nss -D MOZILLA_CLIENT -internal-isystem /usr/lib/llvm-23/lib/clang/23/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/16/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -Wno-error=tautological-type-limit-compare -Wno-range-loop-analysis -Wno-error=deprecated-declarations -Wno-error=array-bounds -Wno-error=free-nonheap-object -Wno-error=atomic-alignment -Wno-error=deprecated-builtins -Wno-psabi -Wno-error=builtin-macro-redefined -Wno-unknown-warning-option -Wno-character-conversion -Wno-parentheses -Wno-pointer-sign -Wno-sign-compare -Wno-switch -Wno-type-limits -Wno-unused-function -Wno-deprecated-declarations -Wno-absolute-value -Wno-incompatible-pointer-types -Wno-string-conversion -Wno-visibility -ferror-limit 19 -fstrict-flex-arrays=1 -stack-protector 2 -fstack-clash-protection -ftrivial-auto-var-init=pattern -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fdiagnostics-absolute-paths -vectorize-loops -vectorize-slp -analyzer-checker optin.performance.Padding -analyzer-output=html -analyzer-config stable-report-filename=true -mllvm -dwarf-linkage-names=Abstract -faddrsig -fdwarf2-cfi-asm -o /tmp/scan-build-2026-09-01-224014-2642839-1 -x c /root/firefox-clang/media/ffvpx/libavcodec/vlc.c
1/*
2 * API for creating VLC trees
3 * Copyright (c) 2000, 2001 Fabrice Bellard
4 * Copyright (c) 2002-2004 Michael Niedermayer <michaelni@gmx.at>
5 * Copyright (c) 2010 Loren Merritt
6 *
7 * This file is part of FFmpeg.
8 *
9 * FFmpeg is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU Lesser General Public
11 * License as published by the Free Software Foundation; either
12 * version 2.1 of the License, or (at your option) any later version.
13 *
14 * FFmpeg is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public
20 * License along with FFmpeg; if not, write to the Free Software
21 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
22 */
23
24#include <inttypes.h>
25#include <stdint.h>
26#include <stdlib.h>
27#include <string.h>
28
29#include "libavutil/attributes.h"
30#include "libavutil/avassert.h"
31#include "libavutil/error.h"
32#include "libavutil/internal.h"
33#include "libavutil/intreadwrite.h"
34#include "libavutil/log.h"
35#include "libavutil/macros.h"
36#include "libavutil/mem.h"
37#include "libavutil/qsort.h"
38#include "libavutil/reverse.h"
39#include "vlc.h"
40
41#define GET_DATA(v, table, i, wrap, size){ const uint8_t *ptr = (const uint8_t *)table + i * wrap; switch
(size) { default: do { av_log(((void*)0), 0, "Reached supposedly unreachable code at %s:%d: %s\n"
, "/root/firefox-clang/media/ffvpx/libavcodec/vlc.c", 41, "Only uint8/16/32_t are used"
); abort(); } while (0); case 1: v = *(const uint8_t *)ptr; break
; case 2: v = *(const uint16_t *)ptr; break; case 4: v = *(const
uint32_t *)ptr; break; } } \
42{ \
43 const uint8_t *ptr = (const uint8_t *)table + i * wrap; \
44 switch(size) { \
45 default: \
46 av_unreachable("Only uint8/16/32_t are used")do { av_log(((void*)0), 0, "Reached supposedly unreachable code at %s:%d: %s\n"
, "/root/firefox-clang/media/ffvpx/libavcodec/vlc.c", 46, "Only uint8/16/32_t are used"
); abort(); } while (0); \
47 case 1: \
48 v = *(const uint8_t *)ptr; \
49 break; \
50 case 2: \
51 v = *(const uint16_t *)ptr; \
52 break; \
53 case 4: \
54 v = *(const uint32_t *)ptr; \
55 break; \
56 } \
57}
58
59
60static int alloc_table(VLC *vlc, int size, int use_static)
61{
62 int index = vlc->table_size;
63
64 vlc->table_size += size;
65 if (vlc->table_size > vlc->table_allocated) {
66 if (use_static)
67 abort(); // cannot do anything, vlc_init() is used with too little memory
68 vlc->table_allocated += (1 << vlc->bits);
69 vlc->table = av_realloc_f(vlc->table, vlc->table_allocated, sizeof(*vlc->table));
70 if (!vlc->table) {
71 vlc->table_allocated = 0;
72 vlc->table_size = 0;
73 return AVERROR(ENOMEM)(-(12));
74 }
75 memset(vlc->table + vlc->table_allocated - (1 << vlc->bits), 0, sizeof(*vlc->table) << vlc->bits);
76 }
77 return index;
78}
79
80#define LOCALBUF_ELEMS1500 1500 // the maximum currently needed is 1296 by rv34
81
82static av_always_inline__attribute__((always_inline)) inline uint32_t bitswap_32(uint32_t x)
83{
84 return (uint32_t)ff_reverse[ x & 0xFF] << 24 |
85 (uint32_t)ff_reverse[(x >> 8) & 0xFF] << 16 |
86 (uint32_t)ff_reverse[(x >> 16) & 0xFF] << 8 |
87 (uint32_t)ff_reverse[ x >> 24];
88}
89
90typedef struct VLCcode {
91 uint8_t bits;
92 VLCBaseType symbol;
93 /** codeword, with the first bit-to-be-read in the msb
94 * (even if intended for a little-endian bitstream reader) */
95 uint32_t code;
96} VLCcode;
97
98static int vlc_common_init(VLC *vlc, int nb_bits, int nb_codes,
99 VLCcode **buf, int flags)
100{
101 vlc->bits = nb_bits;
102 vlc->table_size = 0;
103 if (flags & VLC_INIT_USE_STATIC1) {
104 av_assert0(nb_codes <= LOCALBUF_ELEMS)do { if (!(nb_codes <= 1500)) { av_log(((void*)0), 0, "Assertion %s failed at %s:%d\n"
, "nb_codes <= 1500", "/root/firefox-clang/media/ffvpx/libavcodec/vlc.c"
, 104); abort(); } } while (0);
105 } else {
106 vlc->table = NULL((void*)0);
107 vlc->table_allocated = 0;
108 }
109 if (nb_codes > LOCALBUF_ELEMS1500) {
110 *buf = av_malloc_array(nb_codes, sizeof(VLCcode));
111 if (!*buf)
112 return AVERROR(ENOMEM)(-(12));
113 }
114
115 return 0;
116}
117
118static int compare_vlcspec(const void *a, const void *b)
119{
120 const VLCcode *sa = a, *sb = b;
121 return (sa->code >> 1) - (sb->code >> 1);
122}
123
124/**
125 * Build VLC decoding tables suitable for use with get_vlc().
126 *
127 * @param vlc the context to be initialized
128 *
129 * @param table_nb_bits max length of vlc codes to store directly in this table
130 * (Longer codes are delegated to subtables.)
131 *
132 * @param nb_codes number of elements in codes[]
133 *
134 * @param codes descriptions of the vlc codes
135 * These must be ordered such that codes going into the same subtable are contiguous.
136 * Sorting by VLCcode.code is sufficient, though not necessary.
137 */
138static int build_table(VLC *vlc, int table_nb_bits, int nb_codes,
139 VLCcode *codes, int flags)
140{
141 int table_size, table_index;
142 VLCElem *table;
143
144 if (table_nb_bits > 30)
11
←
Assuming 'table_nb_bits' is <= 30
→
12
←
Taking false branch
→
145 return AVERROR(EINVAL)(-(22));
146 table_size = 1 << table_nb_bits;
147 table_index = alloc_table(vlc, table_size, flags & VLC_INIT_USE_STATIC1);
148 ff_dlog(NULL, "new table index=%d size=%d\n", table_index, table_size)av_log(((void*)0), 48, "new table index=%d size=%d\n", table_index
, table_size);
149 if (table_index
12.1
'table_index' is >= 0
 < 0)
13
←
Taking false branch
→
150 return table_index;
151 table = &vlc->table[table_index];
152
153 /* first pass: map codes and compute auxiliary table sizes */
154 for (int i = 0; i < nb_codes; i++) {
14
←
Loop condition is false. Execution continues on line 221
→
155 int n = codes[i].bits;
156 uint32_t code = codes[i].code;
157 int symbol = codes[i].symbol;
158 ff_tlog(NULL, "i=%d n=%d code=0x%"PRIx32"\n", i, n, code)do { } while(0);
159 if (n <= table_nb_bits) {
160 /* no need to add another table */
161 int j = code >> (32 - table_nb_bits);
162 int nb = 1 << (table_nb_bits - n);
163 int inc = 1;
164
165 if (flags & VLC_INIT_OUTPUT_LE8) {
166 j = bitswap_32(code);
167 inc = 1 << n;
168 }
169 for (int k = 0; k < nb; k++) {
170 int bits = table[j].len;
171 int oldsym = table[j].sym;
172 ff_tlog(NULL, "%4x: code=%d n=%d\n", j, i, n)do { } while(0);
173 if ((bits || oldsym) && (bits != n || oldsym != symbol)) {
174 av_log(NULL((void*)0), AV_LOG_ERROR16, "incorrect codes\n");
175 return AVERROR_INVALIDDATA(-(int)(('I') | (('N') << 8) | (('D') << 16) | ((
unsigned)('A') << 24)));
176 }
177 table[j].len = n;
178 table[j].sym = symbol;
179 j += inc;
180 }
181 } else {
182 /* fill auxiliary table recursively */
183 uint32_t code_prefix;
184 int index, subtable_bits, j, k;
185
186 n -= table_nb_bits;
187 code_prefix = code >> (32 - table_nb_bits);
188 subtable_bits = n;
189 codes[i].bits = n;
190 codes[i].code = code << table_nb_bits;
191 for (k = i + 1; k < nb_codes; k++) {
192 n = codes[k].bits - table_nb_bits;
193 if (n <= 0)
194 break;
195 code = codes[k].code;
196 if (code >> (32 - table_nb_bits) != code_prefix)
197 break;
198 codes[k].bits = n;
199 codes[k].code = code << table_nb_bits;
200 subtable_bits = FFMAX(subtable_bits, n)((subtable_bits) > (n) ? (subtable_bits) : (n));
201 }
202 subtable_bits = FFMIN(subtable_bits, table_nb_bits)((subtable_bits) > (table_nb_bits) ? (table_nb_bits) : (subtable_bits
));
203 j = (flags & VLC_INIT_OUTPUT_LE8) ? bitswap_32(code_prefix) >> (32 - table_nb_bits) : code_prefix;
204 table[j].len = -subtable_bits;
205 ff_dlog(NULL, "%4x: n=%d (subtable)\n",av_log(((void*)0), 48, "%4x: n=%d (subtable)\n", j, codes[i].
bits + table_nb_bits)
206 j, codes[i].bits + table_nb_bits)av_log(((void*)0), 48, "%4x: n=%d (subtable)\n", j, codes[i].
bits + table_nb_bits);
207 index = build_table(vlc, subtable_bits, k-i, codes+i, flags);
208 if (index < 0)
209 return index;
210 /* note: realloc has been done, so reload tables */
211 table = &vlc->table[table_index];
212 table[j].sym = index;
213 if (table[j].sym != index) {
214 avpriv_request_sample(NULL((void*)0), "strange codes");
215 return AVERROR_PATCHWELCOME(-(int)(('P') | (('A') << 8) | (('W') << 16) | ((
unsigned)('E') << 24)));
216 }
217 i = k-1;
218 }
219 }
220
221 for (int i = 0; i
14.1
'i' is < 'table_size'
 < table_size; i++) {
15
←
Loop condition is true. Entering loop body
→
18
←
Assuming 'i' is >= 'table_size'
→
19
←
Loop condition is false. Execution continues on line 226
→
222 if (table[i].len == 0)
16
←
Assuming field 'len' is not equal to 0
→
17
←
Taking false branch
→
223 table[i].sym = -1;
224 }
225
226 return table_index;
227}
228
229static int vlc_common_end(VLC *vlc, int nb_bits, int nb_codes, VLCcode *codes,
230 int flags, VLCcode localbuf[LOCALBUF_ELEMS1500])
231{
232 int ret = build_table(vlc, nb_bits, nb_codes, codes, flags);
10
←
Calling 'build_table'
→
20
←
Returning from 'build_table'
→
233
234 if (flags & VLC_INIT_USE_STATIC1) {
21
←
Taking false branch
→
235 if (vlc->table_size != vlc->table_allocated &&
236 !(flags & (VLC_INIT_STATIC_OVERLONG(2 | 1) & ~VLC_INIT_USE_STATIC1)))
237 av_log(NULL((void*)0), AV_LOG_ERROR16, "needed %d had %d\n", vlc->table_size, vlc->table_allocated);
238 av_assert0(ret >= 0)do { if (!(ret >= 0)) { av_log(((void*)0), 0, "Assertion %s failed at %s:%d\n"
, "ret >= 0", "/root/firefox-clang/media/ffvpx/libavcodec/vlc.c"
, 238); abort(); } } while (0);
239 } else {
240 if (codes
21.1
'codes' is equal to 'localbuf'
 != localbuf)
22
←
Taking false branch
→
241 av_free(codes);
242 if (ret
22.1
'ret' is >= 0
 < 0) {
23
←
Taking false branch
→
243 av_freep(&vlc->table);
244 return ret;
245 }
246 }
247 return 0;
248}
249
250int ff_vlc_init_sparse(VLC *vlc, int nb_bits, int nb_codes,
251 const void *bits, int bits_wrap, int bits_size,
252 const void *codes, int codes_wrap, int codes_size,
253 const void *symbols, int symbols_wrap, int symbols_size,
254 int flags)
255{
256 VLCcode localbuf[LOCALBUF_ELEMS1500], *buf = localbuf;
257 int j, ret;
258
259 ret = vlc_common_init(vlc, nb_bits, nb_codes, &buf, flags);
260 if (ret < 0)
261 return ret;
262
263 av_assert0(symbols_size <= 2U)do { if (!(symbols_size <= 2U)) { av_log(((void*)0), 0, "Assertion %s failed at %s:%d\n"
, "symbols_size <= 2U", "/root/firefox-clang/media/ffvpx/libavcodec/vlc.c"
, 263); abort(); } } while (0);
264 j = 0;
265#define COPY(condition)for (int i = 0; i < nb_codes; i++) { unsigned len; { const
uint8_t *ptr = (const uint8_t *)bits + i * bits_wrap; switch
(bits_size) { default: do { av_log(((void*)0), 0, "Reached supposedly unreachable code at %s:%d: %s\n"
, "/root/firefox-clang/media/ffvpx/libavcodec/vlc.c", 265, "Only uint8/16/32_t are used"
); abort(); } while (0); case 1: len = *(const uint8_t *)ptr;
break; case 2: len = *(const uint16_t *)ptr; break; case 4: len
= *(const uint32_t *)ptr; break; } }; if (!(condition)) continue
; if (len > 3*nb_bits || len > 32) { av_log(((void*)0),
16, "Too long VLC (%u) in vlc_init\n", len); if (buf != localbuf
) av_free(buf); return (-(22)); } buf[j].bits = len; { const uint8_t
*ptr = (const uint8_t *)codes + i * codes_wrap; switch(codes_size
) { default: do { av_log(((void*)0), 0, "Reached supposedly unreachable code at %s:%d: %s\n"
, "/root/firefox-clang/media/ffvpx/libavcodec/vlc.c", 265, "Only uint8/16/32_t are used"
); abort(); } while (0); case 1: buf[j].code = *(const uint8_t
*)ptr; break; case 2: buf[j].code = *(const uint16_t *)ptr; break
; case 4: buf[j].code = *(const uint32_t *)ptr; break; } }; if
(buf[j].code >= (1LL<<buf[j].bits)) { av_log(((void
*)0), 16, "Invalid code %""x"" for %d in " "vlc_init\n", buf[
j].code, i); if (buf != localbuf) av_free(buf); return (-(22)
); } if (flags & 4) buf[j].code = bitswap_32(buf[j].code)
; else buf[j].code <<= 32 - buf[j].bits; if (symbols) {
const uint8_t *ptr = (const uint8_t *)symbols + i * symbols_wrap
; switch(symbols_size) { default: do { av_log(((void*)0), 0, "Reached supposedly unreachable code at %s:%d: %s\n"
, "/root/firefox-clang/media/ffvpx/libavcodec/vlc.c", 265, "Only uint8/16/32_t are used"
); abort(); } while (0); case 1: buf[j].symbol = *(const uint8_t
*)ptr; break; case 2: buf[j].symbol = *(const uint16_t *)ptr
; break; case 4: buf[j].symbol = *(const uint32_t *)ptr; break
; } } else buf[j].symbol = i; j++; }\
266 for (int i = 0; i < nb_codes; i++) { \
267 unsigned len; \
268 GET_DATA(len, bits, i, bits_wrap, bits_size){ const uint8_t *ptr = (const uint8_t *)bits + i * bits_wrap;
switch(bits_size) { default: do { av_log(((void*)0), 0, "Reached supposedly unreachable code at %s:%d: %s\n"
, "/root/firefox-clang/media/ffvpx/libavcodec/vlc.c", 268, "Only uint8/16/32_t are used"
); abort(); } while (0); case 1: len = *(const uint8_t *)ptr;
break; case 2: len = *(const uint16_t *)ptr; break; case 4: len
= *(const uint32_t *)ptr; break; } }; \
269 if (!(condition)) \
270 continue; \
271 if (len > 3*nb_bits || len > 32) { \
272 av_log(NULL((void*)0), AV_LOG_ERROR16, "Too long VLC (%u) in vlc_init\n", len);\
273 if (buf != localbuf) \
274 av_free(buf); \
275 return AVERROR(EINVAL)(-(22)); \
276 } \
277 buf[j].bits = len; \
278 GET_DATA(buf[j].code, codes, i, codes_wrap, codes_size){ const uint8_t *ptr = (const uint8_t *)codes + i * codes_wrap
; switch(codes_size) { default: do { av_log(((void*)0), 0, "Reached supposedly unreachable code at %s:%d: %s\n"
, "/root/firefox-clang/media/ffvpx/libavcodec/vlc.c", 278, "Only uint8/16/32_t are used"
); abort(); } while (0); case 1: buf[j].code = *(const uint8_t
*)ptr; break; case 2: buf[j].code = *(const uint16_t *)ptr; break
; case 4: buf[j].code = *(const uint32_t *)ptr; break; } }; \
279 if (buf[j].code >= (1LL<<buf[j].bits)) { \
280 av_log(NULL((void*)0), AV_LOG_ERROR16, "Invalid code %"PRIx32"x"" for %d in " \
281 "vlc_init\n", buf[j].code, i); \
282 if (buf != localbuf) \
283 av_free(buf); \
284 return AVERROR(EINVAL)(-(22)); \
285 } \
286 if (flags & VLC_INIT_INPUT_LE4) \
287 buf[j].code = bitswap_32(buf[j].code); \
288 else \
289 buf[j].code <<= 32 - buf[j].bits; \
290 if (symbols) \
291 GET_DATA(buf[j].symbol, symbols, i, symbols_wrap, symbols_size){ const uint8_t *ptr = (const uint8_t *)symbols + i * symbols_wrap
; switch(symbols_size) { default: do { av_log(((void*)0), 0, "Reached supposedly unreachable code at %s:%d: %s\n"
, "/root/firefox-clang/media/ffvpx/libavcodec/vlc.c", 291, "Only uint8/16/32_t are used"
); abort(); } while (0); case 1: buf[j].symbol = *(const uint8_t
*)ptr; break; case 2: buf[j].symbol = *(const uint16_t *)ptr
; break; case 4: buf[j].symbol = *(const uint32_t *)ptr; break
; } } \
292 else \
293 buf[j].symbol = i; \
294 j++; \
295 }
296 COPY(len > nb_bits)for (int i = 0; i < nb_codes; i++) { unsigned len; { const
uint8_t *ptr = (const uint8_t *)bits + i * bits_wrap; switch
(bits_size) { default: do { av_log(((void*)0), 0, "Reached supposedly unreachable code at %s:%d: %s\n"
, "/root/firefox-clang/media/ffvpx/libavcodec/vlc.c", 296, "Only uint8/16/32_t are used"
); abort(); } while (0); case 1: len = *(const uint8_t *)ptr;
break; case 2: len = *(const uint16_t *)ptr; break; case 4: len
= *(const uint32_t *)ptr; break; } }; if (!(len > nb_bits
)) continue; if (len > 3*nb_bits || len > 32) { av_log(
((void*)0), 16, "Too long VLC (%u) in vlc_init\n", len); if (
buf != localbuf) av_free(buf); return (-(22)); } buf[j].bits =
len; { const uint8_t *ptr = (const uint8_t *)codes + i * codes_wrap
; switch(codes_size) { default: do { av_log(((void*)0), 0, "Reached supposedly unreachable code at %s:%d: %s\n"
, "/root/firefox-clang/media/ffvpx/libavcodec/vlc.c", 296, "Only uint8/16/32_t are used"
); abort(); } while (0); case 1: buf[j].code = *(const uint8_t
*)ptr; break; case 2: buf[j].code = *(const uint16_t *)ptr; break
; case 4: buf[j].code = *(const uint32_t *)ptr; break; } }; if
(buf[j].code >= (1LL<<buf[j].bits)) { av_log(((void
*)0), 16, "Invalid code %""x"" for %d in " "vlc_init\n", buf[
j].code, i); if (buf != localbuf) av_free(buf); return (-(22)
); } if (flags & 4) buf[j].code = bitswap_32(buf[j].code)
; else buf[j].code <<= 32 - buf[j].bits; if (symbols) {
const uint8_t *ptr = (const uint8_t *)symbols + i * symbols_wrap
; switch(symbols_size) { default: do { av_log(((void*)0), 0, "Reached supposedly unreachable code at %s:%d: %s\n"
, "/root/firefox-clang/media/ffvpx/libavcodec/vlc.c", 296, "Only uint8/16/32_t are used"
); abort(); } while (0); case 1: buf[j].symbol = *(const uint8_t
*)ptr; break; case 2: buf[j].symbol = *(const uint16_t *)ptr
; break; case 4: buf[j].symbol = *(const uint32_t *)ptr; break
; } } else buf[j].symbol = i; j++; };
297 // qsort is the slowest part of vlc_init, and could probably be improved or avoided
298 AV_QSORT(buf, j, struct VLCcode, compare_vlcspec)do { void *stack[64][2]; int sp= 1; stack[0][0] = buf; stack[
0][1] = (buf)+(j)-1; while(sp){ struct VLCcode *start= stack[
--sp][0]; struct VLCcode *end = stack[ sp][1]; while(start <
end){ if(start < end-1) { int checksort=0; struct VLCcode
*right = end-2; struct VLCcode *left = start+1; struct VLCcode
*mid = start + ((end-start)>>1); if(compare_vlcspec(start
, end) > 0) { if(compare_vlcspec( end, mid) > 0) do{struct
VLCcode SWAP_tmp= *mid; *mid= *start; *start= SWAP_tmp;}while
(0); else do{struct VLCcode SWAP_tmp= *end; *end= *start; *start
= SWAP_tmp;}while(0); }else{ if(compare_vlcspec(start, mid) >
0) do{struct VLCcode SWAP_tmp= *mid; *mid= *start; *start= SWAP_tmp
;}while(0); else checksort= 1; } if(compare_vlcspec(mid, end)
> 0){ do{struct VLCcode SWAP_tmp= *end; *end= *mid; *mid=
SWAP_tmp;}while(0); checksort=0; } if(start == end-2) break;
do{struct VLCcode SWAP_tmp= *mid; *mid= end[-1]; end[-1]= SWAP_tmp
;}while(0); while(left <= right){ while(left<=right &&
compare_vlcspec(left, end-1) < 0) left++; while(left<=
right && compare_vlcspec(right, end-1) > 0) right--
; if(left <= right){ do{struct VLCcode SWAP_tmp= *right; *
right= *left; *left= SWAP_tmp;}while(0); left++; right--; } }
do{struct VLCcode SWAP_tmp= *left; *left= end[-1]; end[-1]= SWAP_tmp
;}while(0); if(checksort && (mid == left-1 || mid == left
)){ mid= start; while(mid<end && compare_vlcspec(mid
, mid+1) <= 0) mid++; if(mid==end) break; } if(end-left <
left-start){ stack[sp ][0]= start; stack[sp++][1]= right; start
= left+1; }else{ stack[sp ][0]= left+1; stack[sp++][1]= end;
end = right; } }else{ if(compare_vlcspec(start, end) > 0)
do{struct VLCcode SWAP_tmp= *end; *end= *start; *start= SWAP_tmp
;}while(0); break; } } }} while (0);
299 COPY(len && len <= nb_bits)for (int i = 0; i < nb_codes; i++) { unsigned len; { const
uint8_t *ptr = (const uint8_t *)bits + i * bits_wrap; switch
(bits_size) { default: do { av_log(((void*)0), 0, "Reached supposedly unreachable code at %s:%d: %s\n"
, "/root/firefox-clang/media/ffvpx/libavcodec/vlc.c", 299, "Only uint8/16/32_t are used"
); abort(); } while (0); case 1: len = *(const uint8_t *)ptr;
break; case 2: len = *(const uint16_t *)ptr; break; case 4: len
= *(const uint32_t *)ptr; break; } }; if (!(len && len
<= nb_bits)) continue; if (len > 3*nb_bits || len >
32) { av_log(((void*)0), 16, "Too long VLC (%u) in vlc_init\n"
, len); if (buf != localbuf) av_free(buf); return (-(22)); } buf
[j].bits = len; { const uint8_t *ptr = (const uint8_t *)codes
+ i * codes_wrap; switch(codes_size) { default: do { av_log(
((void*)0), 0, "Reached supposedly unreachable code at %s:%d: %s\n"
, "/root/firefox-clang/media/ffvpx/libavcodec/vlc.c", 299, "Only uint8/16/32_t are used"
); abort(); } while (0); case 1: buf[j].code = *(const uint8_t
*)ptr; break; case 2: buf[j].code = *(const uint16_t *)ptr; break
; case 4: buf[j].code = *(const uint32_t *)ptr; break; } }; if
(buf[j].code >= (1LL<<buf[j].bits)) { av_log(((void
*)0), 16, "Invalid code %""x"" for %d in " "vlc_init\n", buf[
j].code, i); if (buf != localbuf) av_free(buf); return (-(22)
); } if (flags & 4) buf[j].code = bitswap_32(buf[j].code)
; else buf[j].code <<= 32 - buf[j].bits; if (symbols) {
const uint8_t *ptr = (const uint8_t *)symbols + i * symbols_wrap
; switch(symbols_size) { default: do { av_log(((void*)0), 0, "Reached supposedly unreachable code at %s:%d: %s\n"
, "/root/firefox-clang/media/ffvpx/libavcodec/vlc.c", 299, "Only uint8/16/32_t are used"
); abort(); } while (0); case 1: buf[j].symbol = *(const uint8_t
*)ptr; break; case 2: buf[j].symbol = *(const uint16_t *)ptr
; break; case 4: buf[j].symbol = *(const uint32_t *)ptr; break
; } } else buf[j].symbol = i; j++; };
300 nb_codes = j;
301
302 return vlc_common_end(vlc, nb_bits, nb_codes, buf,
303 flags, localbuf);
304}
305
306int ff_vlc_init_from_lengths(VLC *vlc, int nb_bits, int nb_codes,
307 const int8_t *lens, int lens_wrap,
308 const void *symbols, int symbols_wrap, int symbols_size,
309 int offset, int flags, void *logctx)
310{
311 VLCcode localbuf[LOCALBUF_ELEMS1500], *buf = localbuf;
312 uint64_t code;
313 int ret, j, len_max = FFMIN(32, 3 * nb_bits)((32) > (3 * nb_bits) ? (3 * nb_bits) : (32));
314
315 ret = vlc_common_init(vlc, nb_bits, nb_codes, &buf, flags);
316 if (ret < 0)
317 return ret;
318
319 j = code = 0;
320 for (int i = 0; i < nb_codes; i++, lens += lens_wrap) {
321 int len = *lens;
322 if (len > 0) {
323 unsigned sym;
324
325 buf[j].bits = len;
326 if (symbols)
327 GET_DATA(sym, symbols, i, symbols_wrap, symbols_size){ const uint8_t *ptr = (const uint8_t *)symbols + i * symbols_wrap
; switch(symbols_size) { default: do { av_log(((void*)0), 0, "Reached supposedly unreachable code at %s:%d: %s\n"
, "/root/firefox-clang/media/ffvpx/libavcodec/vlc.c", 327, "Only uint8/16/32_t are used"
); abort(); } while (0); case 1: sym = *(const uint8_t *)ptr;
break; case 2: sym = *(const uint16_t *)ptr; break; case 4: sym
= *(const uint32_t *)ptr; break; } }
328 else
329 sym = i;
330 buf[j].symbol = sym + offset;
331 buf[j++].code = code;
332 } else if (len < 0) {
333 len = -len;
334 } else
335 continue;
336 if (len > len_max || code & ((1U << (32 - len)) - 1)) {
337 av_log(logctx, AV_LOG_ERROR16, "Invalid VLC (length %u)\n", len);
338 goto fail;
339 }
340 code += 1U << (32 - len);
341 if (code > UINT32_MAX(4294967295U) + 1ULL) {
342 av_log(logctx, AV_LOG_ERROR16, "Overdetermined VLC tree\n");
343 goto fail;
344 }
345 }
346 return vlc_common_end(vlc, nb_bits, j, buf, flags, localbuf);
347fail:
348 if (buf != localbuf)
349 av_free(buf);
350 return AVERROR_INVALIDDATA(-(int)(('I') | (('N') << 8) | (('D') << 16) | ((
unsigned)('A') << 24)));
351}
352
353av_cold__attribute__((cold)) void ff_vlc_init_table_from_lengths(VLCElem table[], int table_size,
354 int nb_bits, int nb_codes,
355 const int8_t *lens, int lens_wrap,
356 const void *symbols, int symbols_wrap, int symbols_size,
357 int offset, int flags)
358{
359 VLC vlc = { .table = table, .table_allocated = table_size };
360
361 ff_vlc_init_from_lengths(&vlc, nb_bits, nb_codes, lens, lens_wrap,
362 symbols, symbols_wrap, symbols_size,
363 offset, flags | VLC_INIT_USE_STATIC1, NULL((void*)0));
364}
365
366av_cold__attribute__((cold)) const VLCElem *ff_vlc_init_tables_from_lengths(VLCInitState *state,
367 int nb_bits, int nb_codes,
368 const int8_t *lens, int lens_wrap,
369 const void *symbols, int symbols_wrap, int symbols_size,
370 int offset, int flags)
371{
372 VLC vlc = { .table = state->table, .table_allocated = state->size };
373
374 ff_vlc_init_from_lengths(&vlc, nb_bits, nb_codes, lens, lens_wrap,
375 symbols, symbols_wrap, symbols_size,
376 offset, flags | VLC_INIT_STATIC_OVERLONG(2 | 1), NULL((void*)0));
377
378 state->table += vlc.table_size;
379 state->size -= vlc.table_size;
380
381 return vlc.table;
382}
383
384av_cold__attribute__((cold)) void ff_vlc_init_table_sparse(VLCElem table[], int table_size,
385 int nb_bits, int nb_codes,
386 const void *bits, int bits_wrap, int bits_size,
387 const void *codes, int codes_wrap, int codes_size,
388 const void *symbols, int symbols_wrap, int symbols_size,
389 int flags)
390{
391 VLC vlc = { .table = table, .table_allocated = table_size };
392
393 ff_vlc_init_sparse(&vlc, nb_bits, nb_codes,
394 bits, bits_wrap, bits_size,
395 codes, codes_wrap, codes_size,
396 symbols, symbols_wrap, symbols_size,
397 flags | VLC_INIT_USE_STATIC1);
398}
399
400av_cold__attribute__((cold)) const VLCElem *ff_vlc_init_tables_sparse(VLCInitState *state,
401 int nb_bits, int nb_codes,
402 const void *bits, int bits_wrap, int bits_size,
403 const void *codes, int codes_wrap, int codes_size,
404 const void *symbols, int symbols_wrap, int symbols_size,
405 int flags)
406{
407 VLC vlc = { .table = state->table, .table_allocated = state->size };
408
409 ff_vlc_init_sparse(&vlc, nb_bits, nb_codes,
410 bits, bits_wrap, bits_size,
411 codes, codes_wrap, codes_size,
412 symbols, symbols_wrap, symbols_size,
413 flags | VLC_INIT_STATIC_OVERLONG(2 | 1));
414
415 state->table += vlc.table_size;
416 state->size -= vlc.table_size;
417
418 return vlc.table;
419}
420
421static void add_level(VLC_MULTI_ELEM *table, const int is16bit,
422 const int num, const int numbits,
423 const VLCcode *buf,
424 uint32_t curcode, int curlen,
425 int curlimit, int curlevel,
426 const int minlen, const int max,
427 unsigned* levelcnt, VLC_MULTI_ELEM info)
428{
429 int max_symbols = VLC_MULTI_MAX_SYMBOLS6 >> is16bit;
430 for (int i = num-1; i >= max; i--) {
431 for (int j = 0; j < 2; j++) {
432 int newlimit, sym;
433 int t = j ? i-1 : i;
434 int l = buf[t].bits;
435 uint32_t code;
436
437 sym = buf[t].symbol;
438 if (l >= curlimit)
439 return;
440 code = curcode + (buf[t].code >> curlen);
441 newlimit = curlimit - l;
442 l += curlen;
443 if (is16bit) info.val16[curlevel] = sym;
444 else info.val8[curlevel] = sym&0xFF;
445
446 if (curlevel) { // let's not add single entries
447 uint32_t val = code >> (32 - numbits);
448 uint32_t nb = val + (1U << (numbits - l));
449 info.len = l;
450 info.num = curlevel+1;
451 for (; val < nb; val++)
452 AV_COPY64(table+val, &info)(((av_alias64*)(table+val))->u64 = ((const av_alias64*)(&
info))->u64);
453 levelcnt[curlevel-1]++;
454 }
455
456 if (curlevel+1 < max_symbols && newlimit >= minlen) {
457 add_level(table, is16bit, num, numbits, buf,
458 code, l, newlimit, curlevel+1,
459 minlen, max, levelcnt, info);
460 }
461 }
462 }
463}
464
465static int vlc_multi_gen(VLC_MULTI_ELEM *table, const VLC *single,
466 const int is16bit, const int nb_codes, const int numbits,
467 VLCcode *buf, void *logctx)
468{
469 int minbits, maxbits, max;
470 unsigned count[VLC_MULTI_MAX_SYMBOLS6-1] = { 0, };
471 VLC_MULTI_ELEM info = { 0 };
472 int count0 = 0;
473
474 for (int j = 0; j < 1<<numbits; j++) {
28
←
Loop condition is true. Entering loop body
→
32
←
Assuming the condition is false
→
33
←
Loop condition is false. Execution continues on line 481
→
475 if (single->table[j].len > 0) {
29
←
Assuming field 'len' is > 0
→
30
←
Taking true branch
→
476 count0 ++;
477 j += (1 << (numbits - single->table[j].len)) - 1;
31
←
Assuming right operand of bit shift is non-negative
→
478 }
479 }
480
481 minbits = 32;
482 maxbits = 0;
483
484 for (int n = nb_codes - count0; n < nb_codes; n++) {
485 minbits = FFMIN(minbits, buf[n].bits)((minbits) > (buf[n].bits) ? (buf[n].bits) : (minbits));
34
←
Loop condition is true. Entering loop body
→
35
←
The right operand of '>' is a garbage value
486 maxbits = FFMAX(maxbits, buf[n].bits)((maxbits) > (buf[n].bits) ? (maxbits) : (buf[n].bits));
487 }
488 av_assert0(maxbits <= numbits)do { if (!(maxbits <= numbits)) { av_log(((void*)0), 0, "Assertion %s failed at %s:%d\n"
, "maxbits <= numbits", "/root/firefox-clang/media/ffvpx/libavcodec/vlc.c"
, 488); abort(); } } while (0);
489
490 for (max = nb_codes; max > nb_codes - count0; max--) {
491 // We can only add a code that fits with the shortest other code into the table
492 // We assume the table is sorted by bits and we skip subtables which from our
493 // point of view are basically random corrupted entries
494 // If we have not a single usable vlc we end with max = nb_codes
495 if (buf[max - 1].bits+minbits > numbits)
496 break;
497 }
498
499 for (int j = 0; j < 1<<numbits; j++) {
500 table[j].len = single->table[j].len;
501 table[j].num = single->table[j].len > 0 ? 1 : 0;
502 if (is16bit)
503 table[j].val16[0] = single->table[j].sym;
504 else
505 table[j].val8[0] = single->table[j].sym;
506 }
507
508 add_level(table, is16bit, nb_codes, numbits, buf,
509 0, 0, FFMIN(maxbits, numbits)((maxbits) > (numbits) ? (numbits) : (maxbits)), 0, minbits, max, count, info);
510
511 av_log(logctx, AV_LOG_DEBUG48, "Joint: %d/%d/%d/%d/%d codes min=%ubits max=%u\n",
512 count[0], count[1], count[2], count[3], count[4], minbits, max);
513
514 return 0;
515}
516
517int ff_vlc_init_multi_from_lengths(VLC *vlc, VLC_MULTI *multi, int nb_bits, int nb_elems,
518 int nb_codes, const int8_t *lens, int lens_wrap,
519 const void *symbols, int symbols_wrap, int symbols_size,
520 int offset, int flags, void *logctx)
521{
522 VLCcode localbuf[LOCALBUF_ELEMS1500], *buf = localbuf;
523 uint64_t code;
524 int ret, j, len_max = FFMIN(32, 3 * nb_bits)((32) > (3 * nb_bits) ? (3 * nb_bits) : (32));
1
Assuming the condition is false
→
2
←
'?' condition is false
→
525
526 ret = vlc_common_init(vlc, nb_bits, nb_codes, &buf, flags);
527 if (ret
2.1
'ret' is >= 0
 < 0)
3
←
Taking false branch
→
528 return ret;
529
530 multi->table = av_mallocz(sizeof(*multi->table) << nb_bits);
4
←
Assuming right operand of bit shift is non-negative but less than 64
→
531 if (!multi->table)
5
←
Assuming field 'table' is non-null
→
6
←
Taking false branch
→
532 goto fail;
533
534 j = code = 0;
535 for (int i = 0; i < nb_codes; i++, lens += lens_wrap) {
7
←
Assuming 'i' is >= 'nb_codes'
→
8
←
Loop condition is false. Execution continues on line 561
→
536 int len = *lens;
537 if (len > 0) {
538 unsigned sym;
539
540 buf[j].bits = len;
541 if (symbols)
542 GET_DATA(sym, symbols, i, symbols_wrap, symbols_size){ const uint8_t *ptr = (const uint8_t *)symbols + i * symbols_wrap
; switch(symbols_size) { default: do { av_log(((void*)0), 0, "Reached supposedly unreachable code at %s:%d: %s\n"
, "/root/firefox-clang/media/ffvpx/libavcodec/vlc.c", 542, "Only uint8/16/32_t are used"
); abort(); } while (0); case 1: sym = *(const uint8_t *)ptr;
break; case 2: sym = *(const uint16_t *)ptr; break; case 4: sym
= *(const uint32_t *)ptr; break; } }
543 else
544 sym = i;
545 buf[j].symbol = sym + offset;
546 buf[j++].code = code;
547 } else if (len < 0) {
548 len = -len;
549 } else
550 continue;
551 if (len > len_max || code & ((1U << (32 - len)) - 1)) {
552 av_log(logctx, AV_LOG_ERROR16, "Invalid VLC (length %u)\n", len);
553 goto fail;
554 }
555 code += 1U << (32 - len);
556 if (code > UINT32_MAX(4294967295U) + 1ULL) {
557 av_log(logctx, AV_LOG_ERROR16, "Overdetermined VLC tree\n");
558 goto fail;
559 }
560 }
561 ret = vlc_common_end(vlc, nb_bits, j, buf, flags, buf);
9
←
Calling 'vlc_common_end'
→
24
←
Returning from 'vlc_common_end'
→
562 if (ret
24.1
'ret' is >= 0
 < 0)
25
←
Taking false branch
→
563 goto fail;
564 ret = vlc_multi_gen(multi->table, vlc, nb_elems > 256, j, nb_bits, buf, logctx);
26
←
Assuming 'nb_elems' is <= 256
→
27
←
Calling 'vlc_multi_gen'
→
565 if (buf != localbuf)
566 av_free(buf);
567 return ret;
568fail:
569 if (buf != localbuf)
570 av_free(buf);
571 ff_vlc_free_multi(multi);
572 return AVERROR_INVALIDDATA(-(int)(('I') | (('N') << 8) | (('D') << 16) | ((
unsigned)('A') << 24)));
573}
574
575void ff_vlc_free_multi(VLC_MULTI *vlc)
576{
577 av_freep(&vlc->table);
578}
579
580void ff_vlc_free(VLC *vlc)
581{
582 av_freep(&vlc->table);
583}