diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-01-17 00:55:44 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-01-31 00:24:27 +0100 |
| commit | aea2f5a6eeb75bf69853d3ba12128446bbe47a0f (patch) | |
| tree | b79e8c046717424ba6dccd7bc2dafcb9cd6c5b88 | |
| parent | 78c9e1f00b4c96cf33f0a5ab6148b76c244e5ab5 (diff) | |
| download | ffmpeg-aea2f5a6eeb75bf69853d3ba12128446bbe47a0f.tar.gz | |
swscale/swscale_unscaled: Fix odd height inputs for bayer_to_yv12_wrapper()
Fixes: 372d2df1f04b49e25f109f07f90b1505/asan_heap-oob_2835d2e_8501_99e0114d7ba3a6db885d0b4684d200c1.cine
Fixes out of array read
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 757248ea3cd917a7755cb15f817a9b1f15578718)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libswscale/swscale_unscaled.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/libswscale/swscale_unscaled.c b/libswscale/swscale_unscaled.c index 1e5faf6633..228cbba756 100644 --- a/libswscale/swscale_unscaled.c +++ b/libswscale/swscale_unscaled.c @@ -1110,6 +1110,8 @@ static int bayer_to_yv12_wrapper(SwsContext *c, const uint8_t* src[], int srcStr default: return 0; } + av_assert0(srcSliceH > 1); + copy(srcPtr, srcStride[0], dstY, dstU, dstV, dstStride[0], c->srcW, c->input_rgb2yuv_table); srcPtr += 2 * srcStride[0]; dstY += 2 * dstStride[0]; @@ -1124,7 +1126,10 @@ static int bayer_to_yv12_wrapper(SwsContext *c, const uint8_t* src[], int srcStr dstV += dstStride[1]; } - copy(srcPtr, srcStride[0], dstY, dstU, dstV, dstStride[0], c->srcW, c->input_rgb2yuv_table); + if (i + 1 == srcSliceH) { + copy(srcPtr, -srcStride[0], dstY, dstU, dstV, -dstStride[0], c->srcW, c->input_rgb2yuv_table); + } else if (i < srcSliceH) + copy(srcPtr, srcStride[0], dstY, dstU, dstV, dstStride[0], c->srcW, c->input_rgb2yuv_table); return srcSliceH; } |