Skip to content

F
ffmpeg.wasm-core
Commit 0a28c505 authored by Paul B Mahol's avatar Paul B Mahol
Browse files
Options

avcodec/scpr: improve motion vectors checking for out of buffer write 

Signed-off-by: 's avatarPaul B Mahol <onemda@gmail.com>
parent c87ea474
Show whitespace changes
Inline Side-by-side
Showing with 2 additions and 2 deletions
libavcodec/scpr.c
View file @ 0a28c505
...@@ -509,8 +509,8 @@ static int decompress_p(AVCodecContext *avctx, ...@@ -509,8 +509,8 @@ static int decompress_p(AVCodecContext *avctx,
by + mvy + sy1 >= avctx->height || bx + mvx + sx1 >= avctx->width) by + mvy + sy1 >= avctx->height || bx + mvx + sx1 >= avctx->width)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
for (i = 0; i < sy2 - sy1 && (by + sy1 + i) < avctx->height; i++) { for (i = 0; i < sy2 - sy1 && (by + sy1 + i) < avctx->height && (by + mvy + sy1 + i) < avctx->height; i++) {
for (j = 0; j < sx2 - sx1 && (bx + sx1 + j) < avctx->width; j++) { for (j = 0; j < sx2 - sx1 && (bx + sx1 + j) < avctx->width && (bx + mvx + sx1 + j) < avctx->width; j++) {
dst[(by + i + sy1) * linesize + bx + sx1 + j] = prev[(by + mvy + sy1 + i) * plinesize + bx + sx1 + mvx + j]; dst[(by + i + sy1) * linesize + bx + sx1 + j] = prev[(by + mvy + sy1 + i) * plinesize + bx + sx1 + mvx + j];
} }
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment