diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-02-18 02:53:14 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-03-08 16:25:20 +0100 |
| commit | a0d15a6271a7af4113af4c9921e4f17e6271eee5 (patch) | |
| tree | 1af9526b716a18a58553a46154ae116ff88c2e0d /libavcodec/snow.h | |
| parent | d7071f676571465a0fccf41d265cc4f59ec89b92 (diff) | |
| download | ffmpeg-a0d15a6271a7af4113af4c9921e4f17e6271eee5.tar.gz | |
avcodec/snow: split block clipping checks
Fixes out of array read
Fixes: d4476f68ca1c1c57afbc45806f581963-asan_heap-oob_2266b27_8607_cov_4044577381_snow_chroma_bug.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 61d59703c91869f4e5cdacd8d6be52f8b89d4ba4)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/snow.h')
| -rw-r--r-- | libavcodec/snow.h | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavcodec/snow.h b/libavcodec/snow.h index 6d6b086907..675c054962 100644 --- a/libavcodec/snow.h +++ b/libavcodec/snow.h @@ -312,7 +312,8 @@ static av_always_inline void add_yblock(SnowContext *s, int sliced, slice_buffer if(!sliced && !offset_dst) dst -= src_x; src_x=0; - }else if(src_x + b_w > w){ + } + if(src_x + b_w > w){ b_w = w - src_x; } if(src_y<0){ @@ -321,7 +322,8 @@ static av_always_inline void add_yblock(SnowContext *s, int sliced, slice_buffer if(!sliced && !offset_dst) dst -= src_y*dst_stride; src_y=0; - }else if(src_y + b_h> h){ + } + if(src_y + b_h> h){ b_h = h - src_y; } |