highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

eamad: check for out of bound reads when doing MC

Browse Source 
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit da35797359cec148f3fe59894c62727b0422d75a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Laurent Aimar 2011-10-08 23:40:31 +02:00 committed by Michael Niedermayer
parent 7b3c851526
commit 79bafbb0dd
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/eamad.c
View File

@ -85,15 +85,21 @@ static inline void comp_block(MadContext *t, int mb_x, int mb_y,
{ {
MpegEncContext *s = &t->s; MpegEncContext *s = &t->s;
if (j < 4) { if (j < 4) {
unsigned offset = (mb_y*16 + ((j&2)<<2) + mv_y)*t->last_frame.linesize[0] + mb_x*16 + ((j&1)<<3) + mv_x;
if (offset >= (s->height - 7) * t->last_frame.linesize[0] - 7)
return;
comp(t->frame.data[0] + (mb_y*16 + ((j&2)<<2))*t->frame.linesize[0] + mb_x*16 + ((j&1)<<3), comp(t->frame.data[0] + (mb_y*16 + ((j&2)<<2))*t->frame.linesize[0] + mb_x*16 + ((j&1)<<3),
t->frame.linesize[0], t->frame.linesize[0],
t->last_frame.data[0] + (mb_y*16 + ((j&2)<<2) + mv_y)*t->last_frame.linesize[0] + mb_x*16 + ((j&1)<<3) + mv_x, t->last_frame.data[0] + offset,
t->last_frame.linesize[0], add); t->last_frame.linesize[0], add);
} else if (!(s->avctx->flags & CODEC_FLAG_GRAY)) { } else if (!(s->avctx->flags & CODEC_FLAG_GRAY)) {
int index = j - 3; int index = j - 3;
unsigned offset = (mb_y * 8 + (mv_y/2))*t->last_frame.linesize[index] + mb_x * 8 + (mv_x/2);
if (offset >= (s->height/2 - 7) * t->last_frame.linesize[index] - 7)
return;
comp(t->frame.data[index] + (mb_y*8)*t->frame.linesize[index] + mb_x * 8, comp(t->frame.data[index] + (mb_y*8)*t->frame.linesize[index] + mb_x * 8,
t->frame.linesize[index], t->frame.linesize[index],
t->last_frame.data[index] + (mb_y * 8 + (mv_y/2))*t->last_frame.linesize[index] + mb_x * 8 + (mv_x/2), t->last_frame.data[index] + offset,
t->last_frame.linesize[index], add); t->last_frame.linesize[index], add);
} }
} }