Commit 0f88b3f8 authored by Ronald S. Bultje's avatar Ronald S. Bultje

videodsp: fix 1-byte overread in top/bottom READ_NUM_BYTES iterations.

This can overread (either before start or beyond end) of the buffer in
Nx1 (i.e. height=1) images.

Fixes mozilla bug 1240080.
parent 5da1477f
...@@ -193,14 +193,10 @@ hvar_fn ...@@ -193,14 +193,10 @@ hvar_fn
mov valb, [srcq+%2-1] mov valb, [srcq+%2-1]
%elif (%2-%%off) == 2 %elif (%2-%%off) == 2
mov valw, [srcq+%2-2] mov valw, [srcq+%2-2]
%elifidn %1, body %else
mov valb, [srcq+%2-1] mov valb, [srcq+%2-1]
sal vald, 16 ror vald, 16
mov valw, [srcq+%2-3] mov valw, [srcq+%2-3]
%elifidn %1, bottom
movd mm %+ %%mmx_idx, [srcq+%2-4]
%else ; top
movd mm %+ %%mmx_idx, [srcq+%2-3]
%endif %endif
%endif ; (%2-%%off) >= 1 %endif ; (%2-%%off) >= 1
%endmacro ; READ_NUM_BYTES %endmacro ; READ_NUM_BYTES
...@@ -253,18 +249,13 @@ hvar_fn ...@@ -253,18 +249,13 @@ hvar_fn
mov [dstq+%2-1], valb mov [dstq+%2-1], valb
%elif (%2-%%off) == 2 %elif (%2-%%off) == 2
mov [dstq+%2-2], valw mov [dstq+%2-2], valw
%elifidn %1, body
mov [dstq+%2-3], valw
sar vald, 16
mov [dstq+%2-1], valb
%else %else
movd vald, mm %+ %%mmx_idx
%ifidn %1, bottom
sar vald, 8
%endif
mov [dstq+%2-3], valw mov [dstq+%2-3], valw
sar vald, 16 ror vald, 16
mov [dstq+%2-1], valb mov [dstq+%2-1], valb
%ifnidn %1, body
ror vald, 16
%endif
%endif %endif
%endif ; (%2-%%off) >= 1 %endif ; (%2-%%off) >= 1
%endmacro ; WRITE_NUM_BYTES %endmacro ; WRITE_NUM_BYTES
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment