Browse Source

swscale/swscale_unscaled: Fix odd height inputs for bayer_to_yv12_wrapper()

Fixes: 372d2df1f04b49e25f109f07f90b1505/asan_heap-oob_2835d2e_8501_99e0114d7ba3a6db885d0b4684d200c1.cine
Fixes out of array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
tags/n3.0
Michael Niedermayer 9 years ago
parent
commit
757248ea3c
1 changed files with 6 additions and 1 deletions
  1. +6
    -1
      libswscale/swscale_unscaled.c

+ 6
- 1
libswscale/swscale_unscaled.c View File

@@ -1110,6 +1110,8 @@ static int bayer_to_yv12_wrapper(SwsContext *c, const uint8_t* src[], int srcStr
default: return 0;
}

av_assert0(srcSliceH > 1);

copy(srcPtr, srcStride[0], dstY, dstU, dstV, dstStride[0], c->srcW, c->input_rgb2yuv_table);
srcPtr += 2 * srcStride[0];
dstY += 2 * dstStride[0];
@@ -1124,7 +1126,10 @@ static int bayer_to_yv12_wrapper(SwsContext *c, const uint8_t* src[], int srcStr
dstV += dstStride[1];
}

copy(srcPtr, srcStride[0], dstY, dstU, dstV, dstStride[0], c->srcW, c->input_rgb2yuv_table);
if (i + 1 == srcSliceH) {
copy(srcPtr, -srcStride[0], dstY, dstU, dstV, -dstStride[0], c->srcW, c->input_rgb2yuv_table);
} else if (i < srcSliceH)
copy(srcPtr, srcStride[0], dstY, dstU, dstV, dstStride[0], c->srcW, c->input_rgb2yuv_table);
return srcSliceH;
}



Loading…
Cancel
Save