Commit 32f0c658 authored by Michael Niedermayer's avatar Michael Niedermayer

vc1: fix out of array reads in vc1_inv_trans_4x4_c()

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 80c702ef
......@@ -494,7 +494,6 @@ static void vc1_inv_trans_4x4_c(uint8_t *dest, int linesize, DCTELEM *block)
int i;
register int t1,t2,t3,t4;
DCTELEM *src, *dst;
const uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;
src = block;
dst = block;
......@@ -520,10 +519,10 @@ static void vc1_inv_trans_4x4_c(uint8_t *dest, int linesize, DCTELEM *block)
t3 = 22 * src[ 8] + 10 * src[24];
t4 = 22 * src[24] - 10 * src[ 8];
dest[0*linesize] = cm[dest[0*linesize] + ((t1 + t3) >> 7)];
dest[1*linesize] = cm[dest[1*linesize] + ((t2 - t4) >> 7)];
dest[2*linesize] = cm[dest[2*linesize] + ((t2 + t4) >> 7)];
dest[3*linesize] = cm[dest[3*linesize] + ((t1 - t3) >> 7)];
dest[0*linesize] = av_clip_uint8(dest[0*linesize] + ((t1 + t3) >> 7));
dest[1*linesize] = av_clip_uint8(dest[1*linesize] + ((t2 - t4) >> 7));
dest[2*linesize] = av_clip_uint8(dest[2*linesize] + ((t2 + t4) >> 7));
dest[3*linesize] = av_clip_uint8(dest[3*linesize] + ((t1 - t3) >> 7));
src ++;
dest++;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment