[FFmpeg-cvslog] avfilter/vf_overlay: fix crash with negative y

[Paul B Mahol]

ffmpeg | branch: master | Paul B Mahol <onemda at gmail.com> | Tue Nov 20 23:18:47 2018 +0100| [57815cfad5c5d6beb6f3fc0ae86b050a970d3a08] | committer: Paul B Mahol

avfilter/vf_overlay: fix crash with negative y

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=57815cfad5c5d6beb6f3fc0ae86b050a970d3a08
---

 libavfilter/vf_overlay.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/libavfilter/vf_overlay.c b/libavfilter/vf_overlay.c
index ba25893739..a12e7a793f 100644
--- a/libavfilter/vf_overlay.c
+++ b/libavfilter/vf_overlay.c
@@ -473,12 +473,12 @@ static av_always_inline void blend_plane(AVFilterContext *ctx,
     slice_start = (jmax * jobnr) / nb_jobs;
     slice_end = (jmax * (jobnr+1)) / nb_jobs;
 
-    sp = src->data[i] + slice_start * src->linesize[i];
+    sp = src->data[i] + (j + slice_start) * src->linesize[i];
     dp = dst->data[dst_plane]
-                      + (yp + slice_start) * dst->linesize[dst_plane]
+                      + (yp + j + slice_start) * dst->linesize[dst_plane]
                       + dst_offset;
-    ap = src->data[3] + (slice_start << vsub) * src->linesize[3];
-    dap = dst->data[3] + ((yp + slice_start) << vsub) * dst->linesize[3];
+    ap = src->data[3] + (j + slice_start << vsub) * src->linesize[3];
+    dap = dst->data[3] + ((yp + j + slice_start) << vsub) * dst->linesize[3];
 
     for (j = j + slice_start; j < slice_end; j++) {
         k = FFMAX(-xp, 0);