From 6e9bb5aa3ed0b56c484ba96bf1bb3bdd8a9741f3 Mon Sep 17 00:00:00 2001 From: Janne Grunau Date: Mon, 26 Dec 2011 13:38:39 +0100 Subject: swscale: prevent invalid writes in packed_16bpc_bswap Writes past the end of the destination buffer were occuring when its stride was smaller than the stride of the source. Fixes Bug #183. --- libswscale/swscale_unscaled.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'libswscale/swscale_unscaled.c') diff --git a/libswscale/swscale_unscaled.c b/libswscale/swscale_unscaled.c index 34b0f246f1..7c339b6c05 100644 --- a/libswscale/swscale_unscaled.c +++ b/libswscale/swscale_unscaled.c @@ -285,9 +285,10 @@ static int packed_16bpc_bswap(SwsContext *c, const uint8_t *src[], int dststr = dstStride[0] >> 1; uint16_t *dstPtr = (uint16_t *) dst[0]; const uint16_t *srcPtr = (const uint16_t *) src[0]; + int min_stride = FFMIN(srcstr, dststr); for (i = 0; i < srcSliceH; i++) { - for (j = 0; j < srcstr; j++) { + for (j = 0; j < min_stride; j++) { dstPtr[j] = av_bswap16(srcPtr[j]); } srcPtr += srcstr; -- cgit v1.2.3