[FFmpeg-cvslog] vc1: fix out of array reads in vc1_inv_trans_4x8_c()
Michael Niedermayer
git at videolan.org
Thu Mar 1 19:38:30 CET 2012
ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Thu Mar 1 19:18:34 2012 +0100| [80c702efeb7b4d9edaae52ed5d8dd081a2ccb64b] | committer: Michael Niedermayer
vc1: fix out of array reads in vc1_inv_trans_4x8_c()
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=80c702efeb7b4d9edaae52ed5d8dd081a2ccb64b
---
libavcodec/vc1dsp.c | 17 ++++++++---------
1 files changed, 8 insertions(+), 9 deletions(-)
diff --git a/libavcodec/vc1dsp.c b/libavcodec/vc1dsp.c
index 636c82b..d893d69 100644
--- a/libavcodec/vc1dsp.c
+++ b/libavcodec/vc1dsp.c
@@ -421,7 +421,6 @@ static void vc1_inv_trans_4x8_c(uint8_t *dest, int linesize, DCTELEM *block)
int i;
register int t1,t2,t3,t4,t5,t6,t7,t8;
DCTELEM *src, *dst;
- const uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;
src = block;
dst = block;
@@ -457,14 +456,14 @@ static void vc1_inv_trans_4x8_c(uint8_t *dest, int linesize, DCTELEM *block)
t3 = 9 * src[ 8] - 16 * src[24] + 4 * src[40] + 15 * src[56];
t4 = 4 * src[ 8] - 9 * src[24] + 15 * src[40] - 16 * src[56];
- dest[0*linesize] = cm[dest[0*linesize] + ((t5 + t1) >> 7)];
- dest[1*linesize] = cm[dest[1*linesize] + ((t6 + t2) >> 7)];
- dest[2*linesize] = cm[dest[2*linesize] + ((t7 + t3) >> 7)];
- dest[3*linesize] = cm[dest[3*linesize] + ((t8 + t4) >> 7)];
- dest[4*linesize] = cm[dest[4*linesize] + ((t8 - t4 + 1) >> 7)];
- dest[5*linesize] = cm[dest[5*linesize] + ((t7 - t3 + 1) >> 7)];
- dest[6*linesize] = cm[dest[6*linesize] + ((t6 - t2 + 1) >> 7)];
- dest[7*linesize] = cm[dest[7*linesize] + ((t5 - t1 + 1) >> 7)];
+ dest[0*linesize] = av_clip_uint8(dest[0*linesize] + ((t5 + t1) >> 7));
+ dest[1*linesize] = av_clip_uint8(dest[1*linesize] + ((t6 + t2) >> 7));
+ dest[2*linesize] = av_clip_uint8(dest[2*linesize] + ((t7 + t3) >> 7));
+ dest[3*linesize] = av_clip_uint8(dest[3*linesize] + ((t8 + t4) >> 7));
+ dest[4*linesize] = av_clip_uint8(dest[4*linesize] + ((t8 - t4 + 1) >> 7));
+ dest[5*linesize] = av_clip_uint8(dest[5*linesize] + ((t7 - t3 + 1) >> 7));
+ dest[6*linesize] = av_clip_uint8(dest[6*linesize] + ((t6 - t2 + 1) >> 7));
+ dest[7*linesize] = av_clip_uint8(dest[7*linesize] + ((t5 - t1 + 1) >> 7));
src ++;
dest++;
More information about the ffmpeg-cvslog
mailing list