diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-03-08 17:09:27 -0800 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-03-13 23:40:29 +0100 |
| commit | 88c3cc019c8f3ebb9a41ce49c4b7ee6242836849 (patch) | |
| tree | 9dd93ac255f67007bbb2a9fa0225f9447b53453d | |
| parent | 9980e4df3bfcf49da2d3b22ed808b3dca0e7bbf2 (diff) | |
| download | ffmpeg-88c3cc019c8f3ebb9a41ce49c4b7ee6242836849.tar.gz | |
cook: expand dither_tab[], and make sure indexes into it don't overflow.
Fixes overflows in accessing dither_tab[].
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 442c3a8cb1785d74f8e2d7ab35b1862b7088436b)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavcodec/cook.c | 6 | ||||
| -rw-r--r-- | libavcodec/cookdata.h | 4 |
2 files changed, 7 insertions, 3 deletions
diff --git a/libavcodec/cook.c b/libavcodec/cook.c index dc4c2ab170..7c499f0c93 100644 --- a/libavcodec/cook.c +++ b/libavcodec/cook.c @@ -507,7 +507,11 @@ static inline void expand_category(COOKContext *q, int *category, { int i; for (i = 0; i < q->num_vectors; i++) - ++category[category_index[i]]; + { + int idx = category_index[i]; + if (++category[idx] >= FF_ARRAY_ELEMS(dither_tab)) + --category[idx]; + } } /** diff --git a/libavcodec/cookdata.h b/libavcodec/cookdata.h index e8d6ebfcb3..6825a4459c 100644 --- a/libavcodec/cookdata.h +++ b/libavcodec/cookdata.h @@ -36,8 +36,8 @@ static const int expbits_tab[8] = { 52,47,43,37,29,22,16,0, }; -static const float dither_tab[8] = { - 0.0, 0.0, 0.0, 0.0, 0.0, 0.176777, 0.25, 0.707107, +static const float dither_tab[9] = { + 0.0, 0.0, 0.0, 0.0, 0.0, 0.176777, 0.25, 0.707107, 1.0 }; static const float quant_centroid_tab[7][14] = { |