RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/mpegvideo: Fix crash when using lowres with 10bit MPEG-4 

In this case the macroblocks written to are smaller, yet
the MPEG-4 Simple Studio Profile code for 10bit DPCM ignored this;
e.g. in case of lowres = 2 or = 3, the sample mpeg4_sstp_dpcm.m4v
from the FATE-suite reads beyond the end of the buffer.

This commit fixes this by taking lowres into account.
The DPCM macroblocks of the aforementioned sample look
as good as can be expected after this patch; yet the non-DPCM
coded macroblocks are simply corrupt.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This commit is contained in:
Andreas Rheinhardt 2022-01-25 23:07:25 +01:00
parent 9953fc9a23
commit d4d87f2ac5
1 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
libavcodec/mpegvideo.c
View File

@ -1629,13 +1629,17 @@ void mpv_reconstruct_mb_internal(MpegEncContext *s, int16_t block[12][64],
uint16_t *dest_pcm[3] = {(uint16_t*)dest_y, (uint16_t*)dest_cb, (uint16_t*)dest_cr}; uint16_t *dest_pcm[3] = {(uint16_t*)dest_y, (uint16_t*)dest_cb, (uint16_t*)dest_cr};
int linesize[3] = {dct_linesize, uvlinesize, uvlinesize}; int linesize[3] = {dct_linesize, uvlinesize, uvlinesize};
for(i = 0; i < 3; i++) { for(i = 0; i < 3; i++) {
const int16_t *src = (*s->dpcm_macroblock)[i];
int idx = 0; int idx = 0;
int vsub = i ? s->chroma_y_shift : 0; int vsub = i ? s->chroma_y_shift : 0;
int hsub = i ? s->chroma_x_shift : 0; int hsub = i ? s->chroma_x_shift : 0;
for(h = 0; h < (16 >> vsub); h++){ int lowres = lowres_flag ? s->avctx->lowres : 0;
for(w = 0; w < (16 >> hsub); w++) int step = 1 << lowres;
dest_pcm[i][w] = (*s->dpcm_macroblock)[i][idx++]; for (h = 0; h < (16 >> (vsub + lowres)); h++){
for (w = 0, idx = 0; w < (16 >> (hsub + lowres)); w++, idx += step)
dest_pcm[i][w] = src[idx];
dest_pcm[i] += linesize[i] / 2; dest_pcm[i] += linesize[i] / 2;
src += (16 >> hsub) * step;
} }
} }
} else { } else {
@ -1644,13 +1648,17 @@ void mpv_reconstruct_mb_internal(MpegEncContext *s, int16_t block[12][64],
int linesize[3] = {dct_linesize, uvlinesize, uvlinesize}; int linesize[3] = {dct_linesize, uvlinesize, uvlinesize};
av_assert2(s->dpcm_direction == -1); av_assert2(s->dpcm_direction == -1);
for(i = 0; i < 3; i++) { for(i = 0; i < 3; i++) {
const int16_t *src = (*s->dpcm_macroblock)[i];
int idx = 0; int idx = 0;
int vsub = i ? s->chroma_y_shift : 0; int vsub = i ? s->chroma_y_shift : 0;
int hsub = i ? s->chroma_x_shift : 0; int hsub = i ? s->chroma_x_shift : 0;
int lowres = lowres_flag ? s->avctx->lowres : 0;
int step = 1 << lowres;
dest_pcm[i] += (linesize[i] / 2) * ((16 >> vsub) - 1); dest_pcm[i] += (linesize[i] / 2) * ((16 >> vsub) - 1);
for (h = (16 >> vsub) - 1; h >= 0; h--) { for (h = (16 >> (vsub + lowres)) - 1; h >= 0; h--){
for (w = (16 >> hsub) - 1; w >= 0; w--) for (w = (16 >> (hsub + lowres)) - 1, idx = 0; w >= 0; w--, idx += step)
dest_pcm[i][w] = (*s->dpcm_macroblock)[i][idx++]; dest_pcm[i][w] = src[idx];
src += step * (16 >> hsub);
dest_pcm[i] -= linesize[i] / 2; dest_pcm[i] -= linesize[i] / 2;
} }
} }