diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-03-28 21:49:45 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-03-28 21:50:53 +0100 |
| commit | 76e6b1eba1feb5fc9d2ee70962914faff0228db2 (patch) | |
| tree | e92d83bd41841792a990646799764a2c291be232 | |
| parent | 92002db3eb437414281ad4fb6e84e34862f7fc92 (diff) | |
wmv2: Use emu edge mode when the edge is too small
Fixes out of array read
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/wmv2.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/libavcodec/wmv2.c b/libavcodec/wmv2.c index 6676652350..b5d05123ee 100644 --- a/libavcodec/wmv2.c +++ b/libavcodec/wmv2.c @@ -116,7 +116,7 @@ void ff_mspel_motion(MpegEncContext *s, uvlinesize = s->uvlinesize; ptr = ref_picture[0] + (src_y * linesize) + src_x; - if(s->flags&CODEC_FLAG_EMU_EDGE){ + if(s->flags&CODEC_FLAG_EMU_EDGE || src_y <= -15 || src_y >= s->height - 1) if(src_x<1 || src_y<1 || src_x + 17 >= s->h_edge_pos || src_y + h+1 >= v_edge_pos){ s->vdsp.emulated_edge_mc(s->edge_emu_buffer, ptr - 1 - s->linesize, s->linesize, 19, 19, @@ -124,7 +124,6 @@ void ff_mspel_motion(MpegEncContext *s, ptr= s->edge_emu_buffer + 1 + s->linesize; emu=1; } - } s->dsp.put_mspel_pixels_tab[dxy](dest_y , ptr , linesize); s->dsp.put_mspel_pixels_tab[dxy](dest_y+8 , ptr+8 , linesize); |