diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-11-12 16:11:42 +0100 |
|---|---|---|
| committer | Vittorio Giovara <vittorio.giovara@gmail.com> | 2016-09-16 16:28:07 +0200 |
| commit | 136f55207521f0b03194ef5b55ba70f1635d6aee (patch) | |
| tree | 748d440e8b8669d581e1a00e9fca215e796f5a2b | |
| parent | 15fcf6292ed79be274c824fedb099c2665f4cc15 (diff) | |
| download | ffmpeg-136f55207521f0b03194ef5b55ba70f1635d6aee.tar.gz | |
mpegvideo_motion: Handle edge emulation even without unrestricted_mv
Fix out of bounds read.
Bug-Id: 962
Found by: F4B3CD@STARLAB and Agostino Sarubbo
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
| -rw-r--r-- | libavcodec/mpegvideo_motion.c | 19 |
1 files changed, 8 insertions, 11 deletions
diff --git a/libavcodec/mpegvideo_motion.c b/libavcodec/mpegvideo_motion.c index 8074dbaa9f..f6d9613b3c 100644 --- a/libavcodec/mpegvideo_motion.c +++ b/libavcodec/mpegvideo_motion.c @@ -210,17 +210,14 @@ static inline int hpel_motion(MpegEncContext *s, dxy |= (motion_y & 1) << 1; src += src_y * s->linesize + src_x; - if (s->unrestricted_mv) { - if ((unsigned)src_x > FFMAX(s->h_edge_pos - (motion_x & 1) - 8, 0) || - (unsigned)src_y > FFMAX(s->v_edge_pos - (motion_y & 1) - 8, 0)) { - s->vdsp.emulated_edge_mc(s->sc.edge_emu_buffer, src, - s->linesize, s->linesize, - 9, 9, - src_x, src_y, s->h_edge_pos, - s->v_edge_pos); - src = s->sc.edge_emu_buffer; - emu = 1; - } + if ((unsigned)src_x > FFMAX(s->h_edge_pos - (motion_x & 1) - 8, 0) || + (unsigned)src_y > FFMAX(s->v_edge_pos - (motion_y & 1) - 8, 0)) { + s->vdsp.emulated_edge_mc(s->sc.edge_emu_buffer, src, + s->linesize, s->linesize, + 9, 9, src_x, src_y, + s->h_edge_pos, s->v_edge_pos); + src = s->sc.edge_emu_buffer; + emu = 1; } pix_op[dxy](dest, src, s->linesize, 8); return emu; |