RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-29 10:52:20 +00:00
Code Issues Projects Releases Wiki Activity

vc1: fix out of array reads in vc1_inv_trans_8x4_c()

Browse Source 
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-03-01 19:14:50 +01:00
parent b2a7c01733
commit af796ba4b8
1 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libavcodec/vc1dsp.c
View File

@ -348,7 +348,6 @@ static void vc1_inv_trans_8x4_c(uint8_t *dest, int linesize, DCTELEM *block)
int i;
register int t1,t2,t3,t4,t5,t6,t7,t8;
DCTELEM *src, *dst;
const uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;
src = block;
dst = block;
@ -388,10 +387,10 @@ static void vc1_inv_trans_8x4_c(uint8_t *dest, int linesize, DCTELEM *block)
t3 = 22 * src[ 8] + 10 * src[24];
t4 = 22 * src[24] - 10 * src[ 8];
dest[0*linesize] = cm[dest[0*linesize] + ((t1 + t3) >> 7)];
dest[1*linesize] = cm[dest[1*linesize] + ((t2 - t4) >> 7)];
dest[2*linesize] = cm[dest[2*linesize] + ((t2 + t4) >> 7)];
dest[3*linesize] = cm[dest[3*linesize] + ((t1 - t3) >> 7)];
dest[0*linesize] = av_clip_uint8(dest[0*linesize] + ((t1 + t3) >> 7));
dest[1*linesize] = av_clip_uint8(dest[1*linesize] + ((t2 - t4) >> 7));
dest[2*linesize] = av_clip_uint8(dest[2*linesize] + ((t2 + t4) >> 7));
dest[3*linesize] = av_clip_uint8(dest[3*linesize] + ((t1 - t3) >> 7));
src ++;
dest++;