From 997e7692d83ad8c2ce4d5abaf26e9f1e2e68b53b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 6 Jun 2012 19:26:21 +0200 Subject: [PATCH] mpegvideo: fix out of heap array accesses Signed-off-by: Michael Niedermayer (cherry picked from commit 317ca0d3f735fad354c404e8bbac3e1ce9f09b12) Signed-off-by: Michael Niedermayer --- libavcodec/mpegvideo.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/mpegvideo.c b/libavcodec/mpegvideo.c index 16803a00e6..3e90178ffb 100644 --- a/libavcodec/mpegvideo.c +++ b/libavcodec/mpegvideo.c @@ -1429,7 +1429,7 @@ static void draw_line(uint8_t *buf, int sx, int sy, int ex, int ey, y = (x * f) >> 16; fr = (x * f) & 0xFFFF; buf[y * stride + x] += (color * (0x10000 - fr)) >> 16; - buf[(y + 1) * stride + x] += (color * fr ) >> 16; + if(fr) buf[(y + 1) * stride + x] += (color * fr ) >> 16; } } else { if (sy > ey) { @@ -1446,7 +1446,7 @@ static void draw_line(uint8_t *buf, int sx, int sy, int ex, int ey, x = (y*f) >> 16; fr = (y*f) & 0xFFFF; buf[y * stride + x] += (color * (0x10000 - fr)) >> 16; - buf[y * stride + x + 1] += (color * fr ) >> 16; + if(fr) buf[y * stride + x + 1] += (color * fr ) >> 16; } } }