[FFmpeg-cvslog] rv34dsp: avoid use of crop table for idct.

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Thu Mar  1 07:06:53 2012 +0100| [fd88a257015f183f5ec3bff393a2f6cf7c117c02] | committer: Michael Niedermayer

rv34dsp: avoid use of crop table for idct.

Fixes out of array read.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=fd88a257015f183f5ec3bff393a2f6cf7c117c02
---

 libavcodec/rv34dsp.c |    9 ++++-----
 1 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/libavcodec/rv34dsp.c b/libavcodec/rv34dsp.c
index ce5be93..4347999 100644
--- a/libavcodec/rv34dsp.c
+++ b/libavcodec/rv34dsp.c
@@ -55,7 +55,6 @@ static av_always_inline void rv34_row_transform(int temp[16], DCTELEM *block)
  */
 static void rv34_idct_add_c(uint8_t *dst, ptrdiff_t stride, DCTELEM *block){
     int      temp[16];
-    uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;
     int      i;
 
     rv34_row_transform(temp, block);
@@ -67,10 +66,10 @@ static void rv34_idct_add_c(uint8_t *dst, ptrdiff_t stride, DCTELEM *block){
         const int z2 =  7* temp[4*1+i] - 17*temp[4*3+i];
         const int z3 = 17* temp[4*1+i] +  7*temp[4*3+i];
 
-        dst[0] = cm[ dst[0] + ( (z0 + z3) >> 10 ) ];
-        dst[1] = cm[ dst[1] + ( (z1 + z2) >> 10 ) ];
-        dst[2] = cm[ dst[2] + ( (z1 - z2) >> 10 ) ];
-        dst[3] = cm[ dst[3] + ( (z0 - z3) >> 10 ) ];
+        dst[0] = av_clip_uint8( dst[0] + ( (z0 + z3) >> 10 ) );
+        dst[1] = av_clip_uint8( dst[1] + ( (z1 + z2) >> 10 ) );
+        dst[2] = av_clip_uint8( dst[2] + ( (z1 - z2) >> 10 ) );
+        dst[3] = av_clip_uint8( dst[3] + ( (z0 - z3) >> 10 ) );
 
         dst  += stride;
     }