From a979965313d3c9c470950ca20852191cbe442461 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 9 Dec 2004 01:01:11 +0000 Subject: [PATCH] out of buffer access fix Originally committed as revision 3744 to svn://svn.ffmpeg.org/ffmpeg/trunk --- libavcodec/h264.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/libavcodec/h264.c b/libavcodec/h264.c index da601d4cd9..a3f1f2416d 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -2401,18 +2401,23 @@ static void hl_decode_mb(H264Context *h){ if(!s->encoding){ for(i=0; i<16; i++){ uint8_t * const ptr= dest_y + h->block_offset[i]; - uint8_t *topright= ptr + 4 - linesize; - const int topright_avail= (h->topright_samples_available<intra4x4_pred_mode_cache[ scan8[i] ]; int tr; - if(!topright_avail){ - tr= ptr[3 - linesize]*0x01010101; - topright= (uint8_t*) &tr; - }else if(i==5 && h->deblocking_filter){ - tr= *(uint32_t*)h->top_border[mb_x+1]; - topright= (uint8_t*) &tr; - } + if(dir == DIAG_DOWN_LEFT_PRED || dir == VERT_LEFT_PRED){ + const int topright_avail= (h->topright_samples_available<block_offset[i]); + if(!topright_avail){ + tr= ptr[3 - linesize]*0x01010101; + topright= (uint8_t*) &tr; + }else if(i==5 && h->deblocking_filter){ + tr= *(uint32_t*)h->top_border[mb_x+1]; + topright= (uint8_t*) &tr; + }else + topright= ptr + 4 - linesize; + }else + topright= NULL; h->pred4x4[ dir ](ptr, topright, linesize); if(h->non_zero_count_cache[ scan8[i] ]){