diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-01 22:19:36 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-03-01 22:20:07 +0100 |
| commit | 75d11b55d7c6f9417c047500171b8aa42b8b8f50 (patch) | |
| tree | 6443a0c5fa9fc209b6c476ef5d65518acdd377d7 /libavcodec/vc1dec.c | |
| parent | dc945b1fa8ae65a18116d2ba362871aeebc573b0 (diff) | |
vc1: avoid reading beyond the last line in vc1_draw_sprites()
Fixes overread
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/vc1dec.c')
| -rw-r--r-- | libavcodec/vc1dec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c index bffd7b8106..2d3a94cbbd 100644 --- a/libavcodec/vc1dec.c +++ b/libavcodec/vc1dec.c @@ -5072,7 +5072,7 @@ static void vc1_draw_sprites(VC1Context *v, SpriteData* sd) if (!(xoff[sprite] & 0xFFFF) && xadv[sprite] == 1 << 16) { src_h[sprite][0] = iplane + (xoff[sprite] >> 16) + yline * iline; if (ysub[sprite]) - src_h[sprite][1] = iplane + (xoff[sprite] >> 16) + (yline + 1) * iline; + src_h[sprite][1] = iplane + (xoff[sprite] >> 16) + FFMIN(yline + 1, (v->sprite_height>>!!plane)-1) * iline; } else { if (sr_cache[sprite][0] != yline) { if (sr_cache[sprite][1] == yline) { @@ -5084,7 +5084,7 @@ static void vc1_draw_sprites(VC1Context *v, SpriteData* sd) } } if (ysub[sprite] && sr_cache[sprite][1] != yline + 1) { - v->vc1dsp.sprite_h(v->sr_rows[sprite][1], iplane + (yline + 1) * iline, xoff[sprite], xadv[sprite], width); + v->vc1dsp.sprite_h(v->sr_rows[sprite][1], iplane + FFMIN(yline + 1, (v->sprite_height>>!!plane)-1) * iline, xoff[sprite], xadv[sprite], width); sr_cache[sprite][1] = yline + 1; } src_h[sprite][0] = v->sr_rows[sprite][0]; |