diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-11 03:34:09 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-11-11 03:34:40 +0100 |
| commit | dca2fa10d37022684c61166be59294c9f98530d4 (patch) | |
| tree | 7031610bcbaf9934e0b61124c91f468b9e75c75b /libavcodec/diracdec.c | |
| parent | 991f6bf93dc8de6e98e96e3da7b3b3c213e09b5c (diff) | |
| download | ffmpeg-dca2fa10d37022684c61166be59294c9f98530d4.tar.gz | |
diracdec: fix edge emulation check, fixes out of array reads
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/diracdec.c')
| -rw-r--r-- | libavcodec/diracdec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c index 13d9e478b5..a8f59386a6 100644 --- a/libavcodec/diracdec.c +++ b/libavcodec/diracdec.c @@ -1404,8 +1404,8 @@ static int mc_subpel(DiracContext *s, DiracBlock *block, const uint8_t *src[5], } /* fixme: v/h _edge_pos */ - if ((unsigned)x > p->width +EDGE_WIDTH/2 - p->xblen || - (unsigned)y > p->height+EDGE_WIDTH/2 - p->yblen) { + if ((unsigned)x > FFMAX(p->width +EDGE_WIDTH/2 - p->xblen, 0) || + (unsigned)y > FFMAX(p->height+EDGE_WIDTH/2 - p->yblen, 0)) { for (i = 0; i < nplanes; i++) { ff_emulated_edge_mc(s->edge_emu_buffer[i], src[i], p->stride, p->xblen, p->yblen, x, y, |