提交 dca2fa10 编写于 作者: M Michael Niedermayer

diracdec: fix edge emulation check, fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: NMichael Niedermayer <michaelni@gmx.at>
上级 991f6bf9
......@@ -1404,8 +1404,8 @@ static int mc_subpel(DiracContext *s, DiracBlock *block, const uint8_t *src[5],
}
/* fixme: v/h _edge_pos */
if ((unsigned)x > p->width +EDGE_WIDTH/2 - p->xblen ||
(unsigned)y > p->height+EDGE_WIDTH/2 - p->yblen) {
if ((unsigned)x > FFMAX(p->width +EDGE_WIDTH/2 - p->xblen, 0) ||
(unsigned)y > FFMAX(p->height+EDGE_WIDTH/2 - p->yblen, 0)) {
for (i = 0; i < nplanes; i++) {
ff_emulated_edge_mc(s->edge_emu_buffer[i], src[i], p->stride,
p->xblen, p->yblen, x, y,
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册