aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2014-02-18 02:53:14 +0100
committerMichael Niedermayer <michaelni@gmx.at>2014-03-05 03:06:10 +0100
commitb580bae53ac79dafa8578f8cc77e30c435ab3405 (patch)
tree3a7d0bfcfb5926f49fc56ffb5a0eee2159c1f877
parent9085cdd677996fe792eef13bcbc670bf250e302b (diff)
downloadffmpeg-b580bae53ac79dafa8578f8cc77e30c435ab3405.tar.gz
avcodec/snow: split block clipping checks
Fixes out of array read Fixes: d4476f68ca1c1c57afbc45806f581963-asan_heap-oob_2266b27_8607_cov_4044577381_snow_chroma_bug.avi Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 61d59703c91869f4e5cdacd8d6be52f8b89d4ba4) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r--libavcodec/snow.h6
1 files changed, 4 insertions, 2 deletions
diff --git a/libavcodec/snow.h b/libavcodec/snow.h
index a3b0512490..f15b50f65f 100644
--- a/libavcodec/snow.h
+++ b/libavcodec/snow.h
@@ -315,7 +315,8 @@ static av_always_inline void add_yblock(SnowContext *s, int sliced, slice_buffer
if(!sliced && !offset_dst)
dst -= src_x;
src_x=0;
- }else if(src_x + b_w > w){
+ }
+ if(src_x + b_w > w){
b_w = w - src_x;
}
if(src_y<0){
@@ -324,7 +325,8 @@ static av_always_inline void add_yblock(SnowContext *s, int sliced, slice_buffer
if(!sliced && !offset_dst)
dst -= src_y*dst_stride;
src_y=0;
- }else if(src_y + b_h> h){
+ }
+ if(src_y + b_h> h){
b_h = h - src_y;
}