diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-02-21 23:51:33 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-02-23 15:04:07 +0100 |
| commit | 846a9c67ff6ea022a66c3a65789a1ceb367917ba (patch) | |
| tree | a10042d5b261f86f071cea938b208986c2366216 | |
| parent | c8d363a3593a6ba5390ebecde720b71fbc4d6fbb (diff) | |
| download | ffmpeg-846a9c67ff6ea022a66c3a65789a1ceb367917ba.tar.gz | |
avcodec/h264: use subsample factors of the used pixel format
Fixes out of array read
Fixes: 1cb91c36c4e55463f14aacb9bdf55b38-asan_heap-oob_106cbce_5617_cov_11212800_h264_mmx_chroma_intra_lf.mp4
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8c55ff393340998faae887dfac19e7ef128e1e58)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/h264.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/libavcodec/h264.c b/libavcodec/h264.c index 3b5c126079..2ee9e43a70 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -5021,6 +5021,7 @@ static int get_consumed_bytes(int pos, int buf_size) static int output_frame(H264Context *h, AVFrame *dst, Picture *srcp) { AVFrame *src = &srcp->f; + const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(src->format); int i; int ret = av_frame_ref(dst, src); if (ret < 0) @@ -5031,9 +5032,9 @@ static int output_frame(H264Context *h, AVFrame *dst, Picture *srcp) if (!srcp->crop) return 0; - for (i = 0; i < 3; i++) { - int hshift = (i > 0) ? h->chroma_x_shift : 0; - int vshift = (i > 0) ? h->chroma_y_shift : 0; + for (i = 0; i < desc->nb_components; i++) { + int hshift = (i > 0) ? desc->log2_chroma_w : 0; + int vshift = (i > 0) ? desc->log2_chroma_h : 0; int off = ((srcp->crop_left >> hshift) << h->pixel_shift) + (srcp->crop_top >> vshift) * dst->linesize[i]; dst->data[i] += off; |