diff options
| author | Janne Grunau <janne-libav@jannau.net> | 2011-12-26 13:38:39 +0100 |
|---|---|---|
| committer | Janne Grunau <janne-libav@jannau.net> | 2011-12-26 15:50:17 +0100 |
| commit | 6e9bb5aa3ed0b56c484ba96bf1bb3bdd8a9741f3 (patch) | |
| tree | 7c305c4f845b4c7cc03a94d6818399b384903073 /libswscale/swscale_unscaled.c | |
| parent | 80dc7c0160fb27e46fc0caae8af10b3d63730c7c (diff) | |
swscale: prevent invalid writes in packed_16bpc_bswap
Writes past the end of the destination buffer were occuring when its
stride was smaller than the stride of the source. Fixes Bug #183.
Diffstat (limited to 'libswscale/swscale_unscaled.c')
| -rw-r--r-- | libswscale/swscale_unscaled.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libswscale/swscale_unscaled.c b/libswscale/swscale_unscaled.c index 34b0f246f1..7c339b6c05 100644 --- a/libswscale/swscale_unscaled.c +++ b/libswscale/swscale_unscaled.c @@ -285,9 +285,10 @@ static int packed_16bpc_bswap(SwsContext *c, const uint8_t *src[], int dststr = dstStride[0] >> 1; uint16_t *dstPtr = (uint16_t *) dst[0]; const uint16_t *srcPtr = (const uint16_t *) src[0]; + int min_stride = FFMIN(srcstr, dststr); for (i = 0; i < srcSliceH; i++) { - for (j = 0; j < srcstr; j++) { + for (j = 0; j < min_stride; j++) { dstPtr[j] = av_bswap16(srcPtr[j]); } srcPtr += srcstr; |