opensource/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-06 15:49:50 +08:00
Code Issues Packages Projects Releases Wiki Activity

vc1: fix out of array reads in vc1_inv_trans_4x4_c()

Browse Source 
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2012-03-01 19:24:24 +01:00
parent 80c702efeb
commit 32f0c65828
1 changed files with 4 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
libavcodec/vc1dsp.c
View File

@ -494,7 +494,6 @@ static void vc1_inv_trans_4x4_c(uint8_t *dest, int linesize, DCTELEM *block)
int i; int i;
register int t1,t2,t3,t4; register int t1,t2,t3,t4;
DCTELEM *src, *dst; DCTELEM *src, *dst;
const uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;
src = block; src = block;
dst = block; dst = block;
@ -520,10 +519,10 @@ static void vc1_inv_trans_4x4_c(uint8_t *dest, int linesize, DCTELEM *block)
t3 = 22 * src[ 8] + 10 * src[24]; t3 = 22 * src[ 8] + 10 * src[24];
t4 = 22 * src[24] - 10 * src[ 8]; t4 = 22 * src[24] - 10 * src[ 8];
dest[0*linesize] = cm[dest[0*linesize] + ((t1 + t3) >> 7)]; dest[0*linesize] = av_clip_uint8(dest[0*linesize] + ((t1 + t3) >> 7));
dest[1*linesize] = cm[dest[1*linesize] + ((t2 - t4) >> 7)]; dest[1*linesize] = av_clip_uint8(dest[1*linesize] + ((t2 - t4) >> 7));
dest[2*linesize] = cm[dest[2*linesize] + ((t2 + t4) >> 7)]; dest[2*linesize] = av_clip_uint8(dest[2*linesize] + ((t2 + t4) >> 7));
dest[3*linesize] = cm[dest[3*linesize] + ((t1 - t3) >> 7)]; dest[3*linesize] = av_clip_uint8(dest[3*linesize] + ((t1 - t3) >> 7));
src ++; src ++;
dest++; dest++;