diff options
| author | James Almer <jamrial@gmail.com> | 2024-08-13 11:04:51 -0300 |
|---|---|---|
| committer | James Almer <jamrial@gmail.com> | 2024-08-13 14:49:41 -0300 |
| commit | ed618b288f4b689691a8989e50942e48c619fb4d (patch) | |
| tree | 6ed69bef9c4e718995dae7d757152e17d3659cd2 | |
| parent | 2b349f2d73f54b73e4f3b5b3223fff8558e1ab70 (diff) | |
| download | ffmpeg-ed618b288f4b689691a8989e50942e48c619fb4d.tar.gz | |
avcodec/rpzaenc: don't use buffer data beyond the end of a row
Fixes use of uninitized data (masked by the default zeroing of image buffers).
Signed-off-by: James Almer <jamrial@gmail.com>
| -rw-r--r-- | libavcodec/rpzaenc.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/libavcodec/rpzaenc.c b/libavcodec/rpzaenc.c index d84555d6c6..3a1924d385 100644 --- a/libavcodec/rpzaenc.c +++ b/libavcodec/rpzaenc.c @@ -749,20 +749,24 @@ post_skip : if (err > s->sixteen_color_thresh) { // DO SIXTEEN COLOR BLOCK const uint16_t *row_ptr; - int y_size, rgb555; + int y_size, x_size, rgb555; block_offset = get_block_info(&bi, block_counter, 0); pblock_offset = get_block_info(&bi, block_counter, 1); row_ptr = &src_pixels[block_offset]; y_size = FFMIN(4, bi.image_height - bi.row * 4); + x_size = FFMIN(4, bi.image_width - bi.col * 4); for (int y = 0; y < y_size; y++) { - for (int x = 0; x < 4; x++) { + for (int x = 0; x < x_size; x++) { rgb555 = row_ptr[x] & ~0x8000; put_bits(&s->pb, 16, rgb555); } + for (int x = x_size; x < 4; x++) + put_bits(&s->pb, 16, 0); + row_ptr += bi.rowstride; } |