From f9143d2407b38f33b85487fd597c9194f79adb20 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 31 Mar 2012 16:22:30 +0200 Subject: [PATCH] ividsp: prevent pointers from going outside and overreading. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/ivi_dsp.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/libavcodec/ivi_dsp.c b/libavcodec/ivi_dsp.c index 263c06ace3..bedd5dc93c 100644 --- a/libavcodec/ivi_dsp.c +++ b/libavcodec/ivi_dsp.c @@ -87,6 +87,13 @@ void ff_ivi_recompose53(const IVIPlaneDesc *plane, uint8_t *dst, } for (x = 0, indx = 0; x < plane->width; x+=2, indx++) { + if (x+2 >= plane->width) { + b0_ptr --; + b1_ptr --; + b2_ptr --; + b3_ptr --; + } + /* some values calculated in the previous iterations can */ /* be reused in the next ones, so do appropriate copying */ b2_1 = b2_2; // b2[x-1,y ] = b2[x, y ] @@ -174,10 +181,10 @@ void ff_ivi_recompose53(const IVIPlaneDesc *plane, uint8_t *dst, back_pitch = -pitch; - b0_ptr += pitch; - b1_ptr += pitch; - b2_ptr += pitch; - b3_ptr += pitch; + b0_ptr += pitch + 1; + b1_ptr += pitch + 1; + b2_ptr += pitch + 1; + b3_ptr += pitch + 1; } }