[FFmpeg-devel] [PATCH] vp9: don't overread by 4 pixels in ff_vp9_avg4_mmxext().
Ronald S. Bultje
rsbultje at gmail.com
Wed Jun 1 21:32:37 EEST 2022
Hi,
On Tue, May 31, 2022 at 9:21 AM Ronald S. Bultje <rsbultje at gmail.com> wrote:
> If the block is at the end of the allocated buffer and there is no
> padding, this will over-read, which may cause crashes. Reported by
> Firefox.
> ---
> libavcodec/x86/vp9mc.asm | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/libavcodec/x86/vp9mc.asm b/libavcodec/x86/vp9mc.asm
> index f64161b2c2..efc4cfbef1 100644
> --- a/libavcodec/x86/vp9mc.asm
> +++ b/libavcodec/x86/vp9mc.asm
> @@ -604,7 +604,12 @@ cglobal vp9_%1%2 %+ %%szsuf, 5, 5, %8, dst, dstride,
> src, sstride, h
> %%pavg m0, [dstq]
> %%pavg m1, [dstq+d%3]
> %%pavg m2, [dstq+d%4]
> +%if %2 == 4
> + %%srcfn m4, [dstq+d%5]
> + %%pavg m3, m4
> +%else
> %%pavg m3, [dstq+d%5]
> +%endif
> %if %2/mmsize == 8
> %%pavg m4, [dstq+mmsize*4]
> %%pavg m5, [dstq+mmsize*5]
> --
> 2.34.1
>
Merged.
Ronald
More information about the ffmpeg-devel
mailing list