lavfi/smptebars: fix invalid writes

Signed-off-by: Paul B Mahol <onemda@gmail.com>

1 files changed, 30 insertions, 16 deletions

diff --git a/libavfilter/vsrc_testsrc.c b/libavfilter/vsrc_testsrc.c
index 9317f82852..948085786f 100644
--- a/libavfilter/vsrc_testsrc.c
+++ b/libavfilter/vsrc_testsrc.c
@@ -35,6 +35,7 @@
 
 #include <float.h>
 
+#include "libavutil/avassert.h"
 #include "libavutil/common.h"
 #include "libavutil/opt.h"
 #include "libavutil/imgutils.h"
@@ -700,10 +701,28 @@ static const uint8_t pos4ire[4] = {  29,  29,  29, 255 }; /* 11.5% intensity bla
 static const uint8_t i_pixel[4] = {   0,  68, 130, 255 };
 static const uint8_t q_pixel[4] = {  67,   0, 130, 255 };
 
+static void inline draw_bar(TestSourceContext *test, const uint8_t *color,
+                            unsigned x, unsigned y, unsigned w, unsigned h,
+                            AVFrame *frame)
+{
+    FFDrawColor draw_color;
+
+    x = FFMIN(x, test->w - 1);
+    y = FFMIN(y, test->h - 1);
+    w = FFMIN(w, test->w - x);
+    h = FFMIN(h, test->h - y);
+
+    av_assert0(x + w <= test->w);
+    av_assert0(y + h <= test->h);
+
+    ff_draw_color(&test->draw, &draw_color, color);
+    ff_fill_rectangle(&test->draw, &draw_color,
+                      frame->data, frame->linesize, x, y, w, h);
+}
+
 static void smptebars_fill_picture(AVFilterContext *ctx, AVFrame *picref)
 {
     TestSourceContext *test = ctx->priv;
-    FFDrawColor color;
     int r_w, r_h, w_h, p_w, p_h, i, tmp, x = 0;
     const AVPixFmtDescriptor *pixdesc = av_pix_fmt_desc_get(picref->format);
 
@@ -713,34 +732,29 @@ static void smptebars_fill_picture(AVFilterContext *ctx, AVFrame *picref)
     p_w = FFALIGN(r_w * 5 / 4, 1 << pixdesc->log2_chroma_w);
     p_h = test->h - w_h - r_h;
 
-#define DRAW_COLOR(rgba, x, y, w, h)                                    \
-    ff_draw_color(&test->draw, &color, rgba);                           \
-    ff_fill_rectangle(&test->draw, &color,                              \
-                      picref->data, picref->linesize, x, y, w, h)       \
-
     for (i = 0; i < 7; i++) {
-        DRAW_COLOR(rainbow[i], x, 0,   FFMIN(r_w, test->w - x), r_h);
-        DRAW_COLOR(wobnair[i], x, r_h, FFMIN(r_w, test->w - x), w_h);
+        draw_bar(test, rainbow[i], x, 0,   r_w, r_h, picref);
+        draw_bar(test, wobnair[i], x, r_h, r_w, w_h, picref);
         x += r_w;
     }
     x = 0;
-    DRAW_COLOR(i_pixel, x, r_h + w_h, p_w, p_h);
+    draw_bar(test, i_pixel, x, r_h + w_h, p_w, p_h, picref);
     x += p_w;
-    DRAW_COLOR(white, x, r_h + w_h, p_w, p_h);
+    draw_bar(test, white, x, r_h + w_h, p_w, p_h, picref);
     x += p_w;
-    DRAW_COLOR(q_pixel, x, r_h + w_h, p_w, p_h);
+    draw_bar(test, q_pixel, x, r_h + w_h, p_w, p_h, picref);
     x += p_w;
     tmp = FFALIGN(5 * r_w - x,  1 << pixdesc->log2_chroma_w);
-    DRAW_COLOR(black, x, r_h + w_h, tmp, p_h);
+    draw_bar(test, black, x, r_h + w_h, tmp, p_h, picref);
     x += tmp;
     tmp = FFALIGN(r_w / 3,  1 << pixdesc->log2_chroma_w);
-    DRAW_COLOR(neg4ire, x, r_h + w_h, tmp, p_h);
+    draw_bar(test, neg4ire, x, r_h + w_h, tmp, p_h, picref);
     x += tmp;
-    DRAW_COLOR(black, x, r_h + w_h, tmp, p_h);
+    draw_bar(test, black, x, r_h + w_h, tmp, p_h, picref);
     x += tmp;
-    DRAW_COLOR(pos4ire, x, r_h + w_h, tmp, p_h);
+    draw_bar(test, pos4ire, x, r_h + w_h, tmp, p_h, picref);
     x += tmp;
-    DRAW_COLOR(black, x, r_h + w_h, test->w - x, p_h);
+    draw_bar(test, black, x, r_h + w_h, test->w - x, p_h, picref);
 }
 
 static av_cold int smptebars_init(AVFilterContext *ctx, const char *args)