diff options
| author | Alex Converse <alex.converse@gmail.com> | 2012-05-02 12:08:03 -0700 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-05-09 22:33:49 +0200 |
| commit | 6c9b404dba6f29e44ff9ce385c84759e73082cd2 (patch) | |
| tree | bcfbf9e70f71f4fd7fefef65ef77c0f5243dae3e | |
| parent | b2ac7e585e53ef6c99eef09f1b6fce373fb05125 (diff) | |
| download | ffmpeg-6c9b404dba6f29e44ff9ce385c84759e73082cd2.tar.gz | |
motionpixels: Clip YUV values after applying a gradient.
Prevents illegal reads on truncated and malformed input.
CC: libav-stable@libav.org
(cherry picked from commit b5da848facd41169283d7bfe568b83bdfa7fc42e)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit aaa6a666774eb02c351c84e80622a5c69e9b642e)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 50073e2395522b6e2b8698ff0dd06ffaf8cbf8ce)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 2134e7f6e88959513ba1713ad6fd7a7c8d5a0f41)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavcodec/motionpixels.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavcodec/motionpixels.c b/libavcodec/motionpixels.c index f69dcf95fe..349a02d0b1 100644 --- a/libavcodec/motionpixels.c +++ b/libavcodec/motionpixels.c @@ -239,10 +239,13 @@ static void mp_decode_line(MotionPixelsContext *mp, GetBitContext *gb, int y) p = mp_get_yuv_from_rgb(mp, x - 1, y); } else { p.y += mp_gradient(mp, 0, mp_get_vlc(mp, gb)); + p.y = av_clip(p.y, 0, 31); if ((x & 3) == 0) { if ((y & 3) == 0) { p.v += mp_gradient(mp, 1, mp_get_vlc(mp, gb)); + p.v = av_clip(p.v, -32, 31); p.u += mp_gradient(mp, 2, mp_get_vlc(mp, gb)); + p.u = av_clip(p.u, -32, 31); mp->hpt[((y / 4) * mp->avctx->width + x) / 4] = p; } else { p.v = mp->hpt[((y / 4) * mp->avctx->width + x) / 4].v; @@ -266,9 +269,12 @@ static void mp_decode_frame_helper(MotionPixelsContext *mp, GetBitContext *gb) p = mp_get_yuv_from_rgb(mp, 0, y); } else { p.y += mp_gradient(mp, 0, mp_get_vlc(mp, gb)); + p.y = av_clip(p.y, 0, 31); if ((y & 3) == 0) { p.v += mp_gradient(mp, 1, mp_get_vlc(mp, gb)); + p.v = av_clip(p.v, -32, 31); p.u += mp_gradient(mp, 2, mp_get_vlc(mp, gb)); + p.u = av_clip(p.u, -32, 31); } mp->vpt[y] = p; mp_set_rgb_from_yuv(mp, 0, y, &p); |