diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2022-05-31 08:30:37 -0400 |
|---|---|---|
| committer | Ronald S. Bultje <rsbultje@gmail.com> | 2022-06-01 14:31:32 -0400 |
| commit | 6e13c30a8fd45e14303ef4a8e4da3554d5b4ba8e (patch) | |
| tree | fdd2028561c488a2f7b05e148fffc37e5b86207b | |
| parent | d42b410e05ad1c4d6e74aa981b4a4423103291fb (diff) | |
| download | ffmpeg-6e13c30a8fd45e14303ef4a8e4da3554d5b4ba8e.tar.gz | |
vp9: don't overread by 4 pixels in ff_vp9_avg4_mmxext().
If the block is at the end of the allocated buffer and there is no
padding, this will over-read, which may cause crashes. Reported by
Firefox.
| -rw-r--r-- | libavcodec/x86/vp9mc.asm | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/x86/vp9mc.asm b/libavcodec/x86/vp9mc.asm index f64161b2c2..efc4cfbef1 100644 --- a/libavcodec/x86/vp9mc.asm +++ b/libavcodec/x86/vp9mc.asm @@ -604,7 +604,12 @@ cglobal vp9_%1%2 %+ %%szsuf, 5, 5, %8, dst, dstride, src, sstride, h %%pavg m0, [dstq] %%pavg m1, [dstq+d%3] %%pavg m2, [dstq+d%4] +%if %2 == 4 + %%srcfn m4, [dstq+d%5] + %%pavg m3, m4 +%else %%pavg m3, [dstq+d%5] +%endif %if %2/mmsize == 8 %%pavg m4, [dstq+mmsize*4] %%pavg m5, [dstq+mmsize*5] |