avutil/common: assert that bit position in av_zero_extend is valid

Signed-off-by: James Almer <jamrial@gmail.com>

libavutil/common.h

@@ -286,11 +286,14 @@ static av_always_inline av_const unsigned av_clip_uintp2_c(int a, int p)
 /**
  * Clear high bits from an unsigned integer starting with specific bit position
  * @param  a value to clip
- * @param  p bit position to clip at
+ * @param  p bit position to clip at. Must be between 0 and 31.
  * @return clipped value
  */
 static av_always_inline av_const unsigned av_zero_extend_c(unsigned a, unsigned p)
 {
+#if defined(HAVE_AV_CONFIG_H) && defined(ASSERT_LEVEL) && ASSERT_LEVEL >= 2
+    if (p > 31) abort();
+#endif
     return a & ((1U << p) - 1);
 }
 

libavutil/x86/intmath.h

@@ -82,7 +82,16 @@ static av_always_inline av_const int ff_ctzll_x86(long long v)
 #if defined(__BMI2__)
 
 #if AV_GCC_VERSION_AT_LEAST(5,1)
+#if defined(ASSERT_LEVEL) && ASSERT_LEVEL >= 2
+#define av_zero_extend av_zero_extend_bmi2
+static av_always_inline av_const unsigned av_zero_extend_bmi2(unsigned a, unsigned p)
+{
+    if (p > 31) abort();
+    return __builtin_ia32_bzhi_si(a, p);
+}
+#else
 #define av_zero_extend __builtin_ia32_bzhi_si
+#endif
 #elif HAVE_INLINE_ASM
 /* GCC releases before 5.1.0 have a broken bzhi builtin, so for those we
  * implement it using inline assembly
@@ -90,8 +99,11 @@ static av_always_inline av_const int ff_ctzll_x86(long long v)
 #define av_zero_extend av_zero_extend_bmi2
 static av_always_inline av_const unsigned av_zero_extend_bmi2(unsigned a, unsigned p)
 {
+#if defined(ASSERT_LEVEL) && ASSERT_LEVEL >= 2
+    if (p > 31) abort();
+#endif
     if (av_builtin_constant_p(p))
-        return a & ((1 << p) - 1);
+        return a & ((1U << p) - 1);
     else {
         unsigned x;
         __asm__ ("bzhi %2, %1, %0 \n\t" : "=r"(x) : "rm"(a), "r"(p));