Browse Source

avcodec/utvideodec: Fix handling of slice_height=0

Fixes out of array accesses
Fixes: asan_heap-oob_25bcd7e_3783_cov_3553517262_utvideo_rgba_median.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3881606240)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
tags/n2.4.5
Michael Niedermayer 11 years ago
parent
commit
64fdce7802
1 changed files with 4 additions and 0 deletions
  1. +4
    -0
      libavcodec/utvideodec.c

+ 4
- 0
libavcodec/utvideodec.c View File

@@ -214,6 +214,8 @@ static void restore_median(uint8_t *src, int step, int stride,
slice_height = ((((slice + 1) * height) / slices) & cmask) -
slice_start;

if (!slice_height)
continue;
bsrc = src + slice_start * stride;

// first line - left neighbour prediction
@@ -269,6 +271,8 @@ static void restore_median_il(uint8_t *src, int step, int stride,
slice_height = ((((slice + 1) * height) / slices) & cmask) -
slice_start;
slice_height >>= 1;
if (!slice_height)
continue;

bsrc = src + slice_start * stride;



Loading…
Cancel
Save