diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-07-28 16:27:55 +0600 |
|---|---|---|
| committer | Kostya Shishkov <kostya.shishkov@gmail.com> | 2012-07-28 13:35:12 +0200 |
| commit | 2bf369b60c7d56dd73887a0156c37676d0fa7e29 (patch) | |
| tree | 655fba4d80bdd731e1da12673a45d1ea24f07270 /libavcodec | |
| parent | 1100acbab26883007898c53efeb289f562c6e514 (diff) | |
| download | ffmpeg-2bf369b60c7d56dd73887a0156c37676d0fa7e29.tar.gz | |
vc1: avoid reading beyond the last line in vc1_draw_sprites()
Fixes overread
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/vc1dec.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c index 5726c0adbc..fd515c754e 100644 --- a/libavcodec/vc1dec.c +++ b/libavcodec/vc1dec.c @@ -4938,15 +4938,17 @@ static void vc1_draw_sprites(VC1Context *v, SpriteData* sd) int iline = s->current_picture.f.linesize[plane]; int ycoord = yoff[sprite] + yadv[sprite] * row; int yline = ycoord >> 16; + int next_line; ysub[sprite] = ycoord & 0xFFFF; if (sprite) { iplane = s->last_picture.f.data[plane]; iline = s->last_picture.f.linesize[plane]; } + next_line = FFMIN(yline + 1, (v->sprite_height >> !!plane) - 1) * iline; if (!(xoff[sprite] & 0xFFFF) && xadv[sprite] == 1 << 16) { src_h[sprite][0] = iplane + (xoff[sprite] >> 16) + yline * iline; if (ysub[sprite]) - src_h[sprite][1] = iplane + (xoff[sprite] >> 16) + (yline + 1) * iline; + src_h[sprite][1] = iplane + (xoff[sprite] >> 16) + next_line; } else { if (sr_cache[sprite][0] != yline) { if (sr_cache[sprite][1] == yline) { @@ -4958,7 +4960,9 @@ static void vc1_draw_sprites(VC1Context *v, SpriteData* sd) } } if (ysub[sprite] && sr_cache[sprite][1] != yline + 1) { - v->vc1dsp.sprite_h(v->sr_rows[sprite][1], iplane + (yline + 1) * iline, xoff[sprite], xadv[sprite], width); + v->vc1dsp.sprite_h(v->sr_rows[sprite][1], + iplane + next_line, xoff[sprite], + xadv[sprite], width); sr_cache[sprite][1] = yline + 1; } src_h[sprite][0] = v->sr_rows[sprite][0]; |