mirror of https://git.ffmpeg.org/ffmpeg.git
avcodec/mjpegdec: use the correct linesize in the flipping code
Fixes out of array access
No releases should be affected
Depends on 7c3700cd1d
, do not backport without this one
Fixes: asan_heap-oob_14a37fe_9111_cov_1692584941_test4.amv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
f58eab1512
commit
19b41f8645
|
@ -2052,12 +2052,12 @@ the_end:
|
|||
h = FF_CEIL_RSHIFT(h, vshift);
|
||||
}
|
||||
if(dst){
|
||||
uint8_t *dst2 = dst + s->linesize[index]*(h-1);
|
||||
uint8_t *dst2 = dst + s->picture_ptr->linesize[index]*(h-1);
|
||||
for (i=0; i<h/2; i++) {
|
||||
for (j=0; j<w; j++)
|
||||
FFSWAP(int, dst[j], dst2[j]);
|
||||
dst += s->linesize[index];
|
||||
dst2 -= s->linesize[index];
|
||||
dst += s->picture_ptr->linesize[index];
|
||||
dst2 -= s->picture_ptr->linesize[index];
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue