)]}'
{
  "commit": "e8b13a0936be81657c466f6a99f9a86e0365ef99",
  "tree": "fe775d2abe9d7f20fa93df101a43eaa5b0da959b",
  "parents": [
    "32fa66dd23811e4ae4a443a0a455c84e59ebb7f8"
  ],
  "author": {
    "name": "James Zern",
    "email": "jzern@google.com",
    "time": "Thu Mar 05 19:16:02 2026 -0800"
  },
  "committer": {
    "name": "James Zern",
    "email": "jzern@google.com",
    "time": "Fri Mar 06 19:51:55 2026 -0800"
  },
  "message": "Fix int16_t overflow in CDEF search for frames \u003e 32768 pixels\n\nget_filt_error() used FULLPEL_MV (int16_t row/col) to store pixel\npositions within the frame and compute buffer offsets via\nget_offset_from_fullmv(). For frames with height or width exceeding\n32768 pixels, the pixel coordinate overflows int16_t, wrapping to a\nnegative value. This causes get_offset_from_fullmv() to compute a\nnegative buffer offset, resulting in an out-of-bounds read.\n\nFULLPEL_MV was designed for motion vectors (bounded by search range),\nnot for absolute pixel coordinates in large frames. The AV1 spec\nallows frames up to 65536x65536, so these dimensions are within valid\nencoder input range.\n\nReplace FULLPEL_MV + get_offset_from_fullmv() / get_buf_from_fullmv()\nwith direct int arithmetic at all four usage sites in get_filt_error().\nRemove the now-unused mcomp.h include.\n\nBased on original set of patches from Chun-Min Chang.\n\nBug: 489473886\nChange-Id: I01fb3c981a5a7750fc029b6c98fc73f60614849c\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "918f6fd3a6d92bc8b3d4c39bb1e7d6f89934a7d3",
      "old_mode": 33188,
      "old_path": "av1/encoder/pickcdef.c",
      "new_id": "0b14bf870f743738718f459ef20931046b4d9ef7",
      "new_mode": 33188,
      "new_path": "av1/encoder/pickcdef.c"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "dfce8b3b6023faf70ed2ae69ec3fa6960e80c9d8",
      "new_mode": 33188,
      "new_path": "test/encode_large_width_height_test.cc"
    },
    {
      "type": "modify",
      "old_id": "c50f84a2de696484189e7c2039101e3c98c7e959",
      "old_mode": 33188,
      "old_path": "test/test.cmake",
      "new_id": "ddef74db205c869140a8ab0063c5c4aeacf1fd83",
      "new_mode": 33188,
      "new_path": "test/test.cmake"
    }
  ]
}