videolan/ffmpeg
1
Fork 0
mirror of https://git.videolan.org/git/ffmpeg.git synced 2024-08-16 22:35:05 +02:00
Code Releases Activity

eamad: check for out of bound reads when doing MC

Browse Source 
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Laurent Aimar 2011-10-08 23:40:31 +02:00 committed by Michael Niedermayer
parent 6e20554a6d
commit da35797359
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/eamad.c
View File

@ -85,15 +85,21 @@ static inline void comp_block(MadContext *t, int mb_x, int mb_y,
{
MpegEncContext *s = &t->s;
if (j < 4) {
unsigned offset = (mb_y*16 + ((j&2)<<2) + mv_y)*t->last_frame.linesize[0] + mb_x*16 + ((j&1)<<3) + mv_x;
if (offset >= (s->height - 7) * t->last_frame.linesize[0] - 7)
return;
comp(t->frame.data[0] + (mb_y*16 + ((j&2)<<2))*t->frame.linesize[0] + mb_x*16 + ((j&1)<<3),
t->frame.linesize[0],
t->last_frame.data[0] + (mb_y*16 + ((j&2)<<2) + mv_y)*t->last_frame.linesize[0] + mb_x*16 + ((j&1)<<3) + mv_x,
t->last_frame.data[0] + offset,
t->last_frame.linesize[0], add);
} else if (!(s->avctx->flags & CODEC_FLAG_GRAY)) {
int index = j - 3;
unsigned offset = (mb_y * 8 + (mv_y/2))*t->last_frame.linesize[index] + mb_x * 8 + (mv_x/2);
if (offset >= (s->height/2 - 7) * t->last_frame.linesize[index] - 7)
return;
comp(t->frame.data[index] + (mb_y*8)*t->frame.linesize[index] + mb_x * 8,
t->frame.linesize[index],
t->last_frame.data[index] + (mb_y * 8 + (mv_y/2))*t->last_frame.linesize[index] + mb_x * 8 + (mv_x/2),
t->last_frame.data[index] + offset,
t->last_frame.linesize[index], add);
}
}