RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-28 10:22:10 +00:00
Code Issues Projects Releases Wiki Activity

avcodec/pngenc: fix invalid read in sub filter.

Browse Source 
First pixel was computed based on invalid address read, and then
corrected by the following memcpy. After the commit, it's not computed
anymore, and memcpy fills the appropriate area.

Fixes Ticket #3387
This commit is contained in:
Clément Bœsch 2014-02-23 20:11:30 +01:00
parent 72e6913140
commit 57ec555e8e
1 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
libavcodec/pngenc.c
View File

@ -113,6 +113,22 @@ static void sub_png_paeth_prediction(uint8_t *dst, uint8_t *src, uint8_t *top, i
}
}
static void sub_left_prediction(DSPContext *dsp, uint8_t *dst, const uint8_t *src, int bpp, int size)
{
const uint8_t *src1 = src + bpp;
const uint8_t *src2 = src;
int x, unaligned_w;
memcpy(dst, src, bpp);
dst += bpp;
size -= bpp;
unaligned_w = FFMIN(32 - bpp, size);
for (x = 0; x < unaligned_w; x++)
*dst++ = *src1++ - *src2++;
size -= unaligned_w;
dsp->diff_bytes(dst, src1, src2, size);
}
static void png_filter_row(DSPContext *dsp, uint8_t *dst, int filter_type,
uint8_t *src, uint8_t *top, int size, int bpp)
{
@ -123,8 +139,7 @@ static void png_filter_row(DSPContext *dsp, uint8_t *dst, int filter_type,
memcpy(dst, src, size);
break;
case PNG_FILTER_VALUE_SUB:
dsp->diff_bytes(dst, src, src-bpp, size);
memcpy(dst, src, bpp);
sub_left_prediction(dsp, dst, src, bpp, size);
break;
case PNG_FILTER_VALUE_UP:
dsp->diff_bytes(dst, src, top, size);