Browse Source

simple_idct: idct_4col_put: Fix out of array reads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
tags/n0.11
Michael Niedermayer 13 years ago
parent
commit
689f65126b
1 changed files with 4 additions and 5 deletions
  1. +4
    -5
      libavcodec/simple_idct.c

+ 4
- 5
libavcodec/simple_idct.c View File

@@ -53,7 +53,6 @@
static inline void idct4col_put(uint8_t *dest, int line_size, const DCTELEM *col)
{
int c0, c1, c2, c3, a0, a1, a2, a3;
const uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;

a0 = col[8*0];
a1 = col[8*2];
@@ -63,13 +62,13 @@ static inline void idct4col_put(uint8_t *dest, int line_size, const DCTELEM *col
c2 = ((a0 - a2) << (CN_SHIFT - 1)) + (1 << (C_SHIFT - 1));
c1 = a1 * C1 + a3 * C2;
c3 = a1 * C2 - a3 * C1;
dest[0] = cm[(c0 + c1) >> C_SHIFT];
dest[0] = av_clip_uint8((c0 + c1) >> C_SHIFT);
dest += line_size;
dest[0] = cm[(c2 + c3) >> C_SHIFT];
dest[0] = av_clip_uint8((c2 + c3) >> C_SHIFT);
dest += line_size;
dest[0] = cm[(c2 - c3) >> C_SHIFT];
dest[0] = av_clip_uint8((c2 - c3) >> C_SHIFT);
dest += line_size;
dest[0] = cm[(c0 - c1) >> C_SHIFT];
dest[0] = av_clip_uint8((c0 - c1) >> C_SHIFT);
}

#define BF(k) \


Loading…
Cancel
Save