diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-01 07:06:53 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-03-01 07:06:53 +0100 |
| commit | fd88a257015f183f5ec3bff393a2f6cf7c117c02 (patch) | |
| tree | b486e19e1f99d01b7d7e664d3d7120a1c241f077 | |
| parent | 8263212e8659fed37a9ee77c15599610470b4ac5 (diff) | |
| download | ffmpeg-fd88a257015f183f5ec3bff393a2f6cf7c117c02.tar.gz | |
rv34dsp: avoid use of crop table for idct.
Fixes out of array read.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/rv34dsp.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/libavcodec/rv34dsp.c b/libavcodec/rv34dsp.c index ce5be93894..434799921b 100644 --- a/libavcodec/rv34dsp.c +++ b/libavcodec/rv34dsp.c @@ -55,7 +55,6 @@ static av_always_inline void rv34_row_transform(int temp[16], DCTELEM *block) */ static void rv34_idct_add_c(uint8_t *dst, ptrdiff_t stride, DCTELEM *block){ int temp[16]; - uint8_t *cm = ff_cropTbl + MAX_NEG_CROP; int i; rv34_row_transform(temp, block); @@ -67,10 +66,10 @@ static void rv34_idct_add_c(uint8_t *dst, ptrdiff_t stride, DCTELEM *block){ const int z2 = 7* temp[4*1+i] - 17*temp[4*3+i]; const int z3 = 17* temp[4*1+i] + 7*temp[4*3+i]; - dst[0] = cm[ dst[0] + ( (z0 + z3) >> 10 ) ]; - dst[1] = cm[ dst[1] + ( (z1 + z2) >> 10 ) ]; - dst[2] = cm[ dst[2] + ( (z1 - z2) >> 10 ) ]; - dst[3] = cm[ dst[3] + ( (z0 - z3) >> 10 ) ]; + dst[0] = av_clip_uint8( dst[0] + ( (z0 + z3) >> 10 ) ); + dst[1] = av_clip_uint8( dst[1] + ( (z1 + z2) >> 10 ) ); + dst[2] = av_clip_uint8( dst[2] + ( (z1 - z2) >> 10 ) ); + dst[3] = av_clip_uint8( dst[3] + ( (z0 - z3) >> 10 ) ); dst += stride; } |