From 63b61d55f9592e61cc8f7d973482c1120e0dc987 Mon Sep 17 00:00:00 2001 From: Stefano Sabatini Date: Fri, 12 Aug 2011 08:42:35 +0200 Subject: vf_unsharp: fix out-of-buffer read In apply_unsharp(), when y is >= height, prevent out-of-buffer reading from src, read from the last buffer line in src2 instead. The check was implemented in the original unsharp libmpcodecs code and lost in the port. This also fixes output discrepancy between the two filters. --- libavfilter/vf_unsharp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'libavfilter/vf_unsharp.c') diff --git a/libavfilter/vf_unsharp.c b/libavfilter/vf_unsharp.c index bdbfd304e2..ce728283d0 100644 --- a/libavfilter/vf_unsharp.c +++ b/libavfilter/vf_unsharp.c @@ -73,6 +73,7 @@ static void apply_unsharp( uint8_t *dst, int dst_stride, int32_t res; int x, y, z; + const uint8_t *src2; if (!fp->amount) { if (dst_stride == src_stride) @@ -87,9 +88,12 @@ static void apply_unsharp( uint8_t *dst, int dst_stride, memset(sc[y], 0, sizeof(sc[y][0]) * (width + 2 * fp->steps_x)); for (y = -fp->steps_y; y < height + fp->steps_y; y++) { + if (y < height) + src2 = src; + memset(sr, 0, sizeof(sr[0]) * (2 * fp->steps_x - 1)); for (x = -fp->steps_x; x < width + fp->steps_x; x++) { - tmp1 = x <= 0 ? src[0] : x >= width ? src[width-1] : src[x]; + tmp1 = x <= 0 ? src2[0] : x >= width ? src2[width-1] : src2[x]; for (z = 0; z < fp->steps_x * 2; z += 2) { tmp2 = sr[z + 0] + tmp1; sr[z + 0] = tmp1; tmp1 = sr[z + 1] + tmp2; sr[z + 1] = tmp2; -- cgit v1.2.3