diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-12-16 20:45:31 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-12-21 04:40:35 +0100 |
| commit | b9d2c2e9870142e8255d93fa6a004d012b4caa42 (patch) | |
| tree | 614247dd008eaf5f24ade06c2d5b817fd023de97 | |
| parent | 24fefa73dba44d07b4cef8b6243cfa37f6ec3e54 (diff) | |
| download | ffmpeg-b9d2c2e9870142e8255d93fa6a004d012b4caa42.tar.gz | |
avcodec/utvideodec: Fix handling of slice_height=0
Fixes out of array accesses
Fixes: asan_heap-oob_25bcd7e_3783_cov_3553517262_utvideo_rgba_median.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3881606240953b9275a247a1c98a567f3c44890f)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/utvideodec.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/utvideodec.c b/libavcodec/utvideodec.c index b7af31e48f..188322dff8 100644 --- a/libavcodec/utvideodec.c +++ b/libavcodec/utvideodec.c @@ -212,6 +212,8 @@ static void restore_median(uint8_t *src, int step, int stride, slice_height = ((((slice + 1) * height) / slices) & cmask) - slice_start; + if (!slice_height) + continue; bsrc = src + slice_start * stride; // first line - left neighbour prediction @@ -267,6 +269,8 @@ static void restore_median_il(uint8_t *src, int step, int stride, slice_height = ((((slice + 1) * height) / slices) & cmask) - slice_start; slice_height >>= 1; + if (!slice_height) + continue; bsrc = src + slice_start * stride; |