diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-02 22:09:44 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-03-02 22:09:44 +0100 |
| commit | 689f65126be8a55e8a1e706cb56b19bb975c20ce (patch) | |
| tree | 94d54277a5ad0c306b3abaaa8e00eb820f0ff4a2 | |
| parent | 422e3a74b9d783571bec775af64f75e4915c40cc (diff) | |
| download | ffmpeg-689f65126be8a55e8a1e706cb56b19bb975c20ce.tar.gz | |
simple_idct: idct_4col_put: Fix out of array reads.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/simple_idct.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/libavcodec/simple_idct.c b/libavcodec/simple_idct.c index 0676cf65fc..1bf2d56ba4 100644 --- a/libavcodec/simple_idct.c +++ b/libavcodec/simple_idct.c @@ -53,7 +53,6 @@ static inline void idct4col_put(uint8_t *dest, int line_size, const DCTELEM *col) { int c0, c1, c2, c3, a0, a1, a2, a3; - const uint8_t *cm = ff_cropTbl + MAX_NEG_CROP; a0 = col[8*0]; a1 = col[8*2]; @@ -63,13 +62,13 @@ static inline void idct4col_put(uint8_t *dest, int line_size, const DCTELEM *col c2 = ((a0 - a2) << (CN_SHIFT - 1)) + (1 << (C_SHIFT - 1)); c1 = a1 * C1 + a3 * C2; c3 = a1 * C2 - a3 * C1; - dest[0] = cm[(c0 + c1) >> C_SHIFT]; + dest[0] = av_clip_uint8((c0 + c1) >> C_SHIFT); dest += line_size; - dest[0] = cm[(c2 + c3) >> C_SHIFT]; + dest[0] = av_clip_uint8((c2 + c3) >> C_SHIFT); dest += line_size; - dest[0] = cm[(c2 - c3) >> C_SHIFT]; + dest[0] = av_clip_uint8((c2 - c3) >> C_SHIFT); dest += line_size; - dest[0] = cm[(c0 - c1) >> C_SHIFT]; + dest[0] = av_clip_uint8((c0 - c1) >> C_SHIFT); } #define BF(k) \ |