[FFmpeg-cvslog] vp9: don't overread by 4 pixels in ff_vp9_avg4_mmxext().

[Ronald S. Bultje]

ffmpeg | branch: master | Ronald S. Bultje <rsbultje at gmail.com> | Tue May 31 08:30:37 2022 -0400| [6e13c30a8fd45e14303ef4a8e4da3554d5b4ba8e] | committer: Ronald S. Bultje

vp9: don't overread by 4 pixels in ff_vp9_avg4_mmxext().

If the block is at the end of the allocated buffer and there is no
padding, this will over-read, which may cause crashes. Reported by
Firefox.

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6e13c30a8fd45e14303ef4a8e4da3554d5b4ba8e
---

 libavcodec/x86/vp9mc.asm | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libavcodec/x86/vp9mc.asm b/libavcodec/x86/vp9mc.asm
index f64161b2c2..efc4cfbef1 100644
--- a/libavcodec/x86/vp9mc.asm
+++ b/libavcodec/x86/vp9mc.asm
@@ -604,7 +604,12 @@ cglobal vp9_%1%2 %+ %%szsuf, 5, 5, %8, dst, dstride, src, sstride, h
     %%pavg      m0, [dstq]
     %%pavg      m1, [dstq+d%3]
     %%pavg      m2, [dstq+d%4]
+%if %2 == 4
+    %%srcfn     m4, [dstq+d%5]
+    %%pavg      m3, m4
+%else
     %%pavg      m3, [dstq+d%5]
+%endif
 %if %2/mmsize == 8
     %%pavg      m4, [dstq+mmsize*4]
     %%pavg      m5, [dstq+mmsize*5]