From b84d1bf193d2af5e06979db12ffa0dedaa6c8ea1 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 7 Dec 2012 00:27:08 +0100 Subject: [PATCH] diracdec: fix emulated_edge condition, fix out of array reads Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/diracdec.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c index 8e62391555..ef75a536ed 100644 --- a/libavcodec/diracdec.c +++ b/libavcodec/diracdec.c @@ -1409,8 +1409,9 @@ static int mc_subpel(DiracContext *s, DiracBlock *block, const uint8_t *src[5], } /* fixme: v/h _edge_pos */ - if ((unsigned)x > FFMAX(p->width +EDGE_WIDTH/2 - p->xblen, 0) || - (unsigned)y > FFMAX(p->height+EDGE_WIDTH/2 - p->yblen, 0)) { + if (x + p->xblen > p->width +EDGE_WIDTH/2 || + y + p->yblen > p->height+EDGE_WIDTH/2 || + x < 0 || y < 0) { for (i = 0; i < nplanes; i++) { ff_emulated_edge_mc(s->edge_emu_buffer[i], src[i], p->stride, p->xblen, p->yblen, x, y,