diff options
| author | Martin Storsjö <martin@martin.st> | 2010-07-16 17:45:50 +0000 |
|---|---|---|
| committer | Martin Storsjö <martin@martin.st> | 2010-07-16 17:45:50 +0000 |
| commit | c4e2b8268f9c59a34d60e48afe8541b042d8b4e6 (patch) | |
| tree | 368af0967c811eaf60d79cff25d2dbc05b2302e0 /libswscale | |
| parent | 66b84e4ab2fc96222dab32173d84f4a403129deb (diff) | |
| download | ffmpeg-c4e2b8268f9c59a34d60e48afe8541b042d8b4e6.tar.gz | |
In planarCopyWrapper, Only copy length, not stride of the last line in the plane
If the destination planes are offset within the destination buffer,
writing the extra bytes at the end may write outside of the destination
buffer.
Originally committed as revision 31746 to svn://svn.mplayerhq.hu/mplayer/trunk/libswscale
Diffstat (limited to 'libswscale')
| -rw-r--r-- | libswscale/swscale.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/libswscale/swscale.c b/libswscale/swscale.c index 159bf9cc81..b589131375 100644 --- a/libswscale/swscale.c +++ b/libswscale/swscale.c @@ -1663,9 +1663,11 @@ static int planarCopyWrapper(SwsContext *c, const uint8_t* src[], int srcStride[ srcPtr+= srcStride[plane]; dstPtr+= dstStride[plane]; } - } else if (dstStride[plane]==srcStride[plane] && srcStride[plane] > 0) - memcpy(dst[plane] + dstStride[plane]*y, src[plane], height*dstStride[plane]); - else { + } else if (dstStride[plane]==srcStride[plane] && srcStride[plane] > 0) { + if (height > 0) + memcpy(dst[plane] + dstStride[plane]*y, src[plane], + (height - 1)*dstStride[plane] + length); + } else { if(is16BPS(c->srcFormat) && is16BPS(c->dstFormat)) length*=2; for (i=0; i<height; i++) { |