diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-02-05 00:12:08 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-02-05 00:42:45 +0100 |
| commit | 813054c4bd5d47fc9b2b45fa53c020239af66b70 (patch) | |
| tree | f7198743df1368299fe9daa6e0a0d45ef2c8c0e1 | |
| parent | b844584c10170e47654d7f8d58d8126cde62e8ba (diff) | |
| download | ffmpeg-813054c4bd5d47fc9b2b45fa53c020239af66b70.tar.gz | |
swscale/utils: Limit filter shifting so as not to read from prior the array
Fixes out of array read
Fixes: asan_heap-oob_1fb2f9b_3780_cov_3984375136_usf.mkv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 692b22626ec9a9585f667c124a186b1a9796e432)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libswscale/utils.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/libswscale/utils.c b/libswscale/utils.c index 3cc2c9d4d7..970e3a931e 100644 --- a/libswscale/utils.c +++ b/libswscale/utils.c @@ -596,14 +596,15 @@ static av_cold int initFilter(int16_t **outFilter, int32_t **filterPos, } if ((*filterPos)[i] + filterSize > srcW) { - int shift = (*filterPos)[i] + filterSize - srcW; + int shift = (*filterPos)[i] + FFMIN(filterSize - srcW, 0); + // move filter coefficients right to compensate for filterPos for (j = filterSize - 2; j >= 0; j--) { int right = FFMIN(j + shift, filterSize - 1); filter[i * filterSize + right] += filter[i * filterSize + j]; filter[i * filterSize + j] = 0; } - (*filterPos)[i]= srcW - filterSize; + (*filterPos)[i]-= shift; } } |