highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/utvideodec: Fix handling of slice_height=0

Browse Source 
Fixes out of array accesses
Fixes: asan_heap-oob_25bcd7e_3783_cov_3553517262_utvideo_rgba_median.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2014-12-16 20:45:31 +01:00
parent a9a3c005b8
commit 3881606240
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/utvideodec.c
View File

@@ -215,6 +215,8 @@ static void restore_median(uint8_t *src, int step, int stride,
slice_height = ((((slice + 1) * height) / slices) & cmask) - slice_height = ((((slice + 1) * height) / slices) & cmask) -
slice_start; slice_start;
if (!slice_height)
continue;
bsrc = src + slice_start * stride; bsrc = src + slice_start * stride;
// first line - left neighbour prediction // first line - left neighbour prediction
@@ -270,6 +272,8 @@ static void restore_median_il(uint8_t *src, int step, int stride,
slice_height = ((((slice + 1) * height) / slices) & cmask) - slice_height = ((((slice + 1) * height) / slices) & cmask) -
slice_start; slice_start;
slice_height >>= 1; slice_height >>= 1;
if (!slice_height)
continue;
bsrc = src + slice_start * stride; bsrc = src + slice_start * stride;