aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec
diff options
context:
space:
mode:
authorAndreas Rheinhardt <andreas.rheinhardt@gmail.com>2020-09-15 03:03:18 +0200
committerAndreas Rheinhardt <andreas.rheinhardt@gmail.com>2020-09-15 19:25:26 +0200
commite42fc6263379176869dd9a6467e37f9956d56431 (patch)
treec3b3d082c6c5786418d13b6e189d1e13f01ba8af /libavcodec
parentb78031cf1670c176e97f62ad6a4865d3a44c1507 (diff)
downloadffmpeg-e42fc6263379176869dd9a6467e37f9956d56431.tar.gz
avcodec/mobiclip: Fix heap-buffer-overflow
The MobiClip decoder uses adjacent pixels for prediction; yet when accessing the left pixel, it was forgotten to clip the x coordinate. This results in an heap-buffer-overflow. It can e.g. be reproduced with the sample from https://samples.ffmpeg.org/V-codecs/MOHD/crap.avi when forcing the video decoder to mobiclip. Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Diffstat (limited to 'libavcodec')
-rw-r--r--libavcodec/mobiclip.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/mobiclip.c b/libavcodec/mobiclip.c
index 8758e7f617..47387fce90 100644
--- a/libavcodec/mobiclip.c
+++ b/libavcodec/mobiclip.c
@@ -905,7 +905,7 @@ static int predict_intra(AVCodecContext *avctx, AVFrame *frame, int ax, int ay,
int arr1[16];
int arr2[16];
uint8_t *top = frame->data[plane] + FFMAX(ay - 1, 0) * frame->linesize[plane] + ax;
- uint8_t *left = frame->data[plane] + ay * frame->linesize[plane] + ax - 1;
+ uint8_t *left = frame->data[plane] + ay * frame->linesize[plane] + FFMAX(ax - 1, 0);
int bottommost = frame->data[plane][(ay + size - 1) * frame->linesize[plane] + FFMAX(ax - 1, 0)];
int rightmost = frame->data[plane][FFMAX(ay - 1, 0) * frame->linesize[plane] + ax + size - 1];
int avg = (bottommost + rightmost + 1) / 2 + 2 * get_se_golomb(gb);