diff options
| author | Stefano Sabatini <stefano.sabatini-lala@poste.it> | 2011-08-12 08:42:35 +0200 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-02-08 14:38:31 +0100 |
| commit | 734a9bb05f2b5c09c43d6c26c75dae6af3f51fa2 (patch) | |
| tree | fe2f135cecf8bed26d041f6cb40e9e7e6fdd2802 | |
| parent | 7f62cf120bd066964d93617c73bd5f9f2ee9de00 (diff) | |
| download | ffmpeg-734a9bb05f2b5c09c43d6c26c75dae6af3f51fa2.tar.gz | |
vf_unsharp: fix out-of-buffer read
In apply_unsharp(), when y is >= height, prevent out-of-buffer reading
from src, read from the last buffer line in src2 instead.
The check was implemented in the original unsharp libmpcodecs code and
lost in the port.
This also fixes output discrepancy between the two filters.
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 998e8519efbc772994c5ba19c0d39573998be9db)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavfilter/vf_unsharp.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/libavfilter/vf_unsharp.c b/libavfilter/vf_unsharp.c index 274b13c296..1c3d577ad1 100644 --- a/libavfilter/vf_unsharp.c +++ b/libavfilter/vf_unsharp.c @@ -70,6 +70,7 @@ static void unsharpen(uint8_t *dst, uint8_t *src, int dst_stride, int src_stride int32_t res; int x, y, z; + const uint8_t *src2; if (!fp->amount) { if (dst_stride == src_stride) @@ -84,9 +85,12 @@ static void unsharpen(uint8_t *dst, uint8_t *src, int dst_stride, int src_stride memset(sc[y], 0, sizeof(sc[y][0]) * (width + 2 * fp->steps_x)); for (y = -fp->steps_y; y < height + fp->steps_y; y++) { + if (y < height) + src2 = src; + memset(sr, 0, sizeof(sr[0]) * (2 * fp->steps_x - 1)); for (x = -fp->steps_x; x < width + fp->steps_x; x++) { - tmp1 = x <= 0 ? src[0] : x >= width ? src[width-1] : src[x]; + tmp1 = x <= 0 ? src2[0] : x >= width ? src2[width-1] : src2[x]; for (z = 0; z < fp->steps_x * 2; z += 2) { tmp2 = sr[z + 0] + tmp1; sr[z + 0] = tmp1; tmp1 = sr[z + 1] + tmp2; sr[z + 1] = tmp2; |