diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2024-08-19 16:25:27 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-08-28 16:27:54 +0200 |
| commit | b08776e3ae9a5315c19e8619ca71921006c1abe1 (patch) | |
| tree | aa0925d43f76971735f75d39e2edaf529417a6b0 | |
| parent | e758b24396a427598ebb13e1589f6aeccdae0466 (diff) | |
| download | ffmpeg-b08776e3ae9a5315c19e8619ca71921006c1abe1.tar.gz | |
avcodec/magicyuvenc: better slice height
Fixes: Use of uninitialized value
Fixes: 71072/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer-4835252046987264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/magicyuvenc.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/magicyuvenc.c b/libavcodec/magicyuvenc.c index 93eabb9f9a..6e640d24cc 100644 --- a/libavcodec/magicyuvenc.c +++ b/libavcodec/magicyuvenc.c @@ -378,11 +378,14 @@ static int count_plane_slice(AVCodecContext *avctx, int n, int plane) Slice *sl = &s->slices[n * s->planes + plane]; const uint8_t *dst = sl->slice; PTable *counts = sl->counts; + const int slice_height = s->slice_height; + const int last_height = FFMIN(slice_height, avctx->height - n * slice_height); + const int height = (n < (s->nb_slices - 1)) ? slice_height : last_height; memset(counts, 0, sizeof(sl->counts)); count_usage(dst, AV_CEIL_RSHIFT(avctx->width, s->hshift[plane]), - AV_CEIL_RSHIFT(s->slice_height, s->vshift[plane]), counts); + AV_CEIL_RSHIFT(height, s->vshift[plane]), counts); return 0; } |