Commit 61d59703 authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/snow: split block clipping checks

Fixes out of array read
Fixes: d4476f68ca1c1c57afbc45806f581963-asan_heap-oob_2266b27_8607_cov_4044577381_snow_chroma_bug.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent c57fc97e
...@@ -318,7 +318,8 @@ static av_always_inline void add_yblock(SnowContext *s, int sliced, slice_buffer ...@@ -318,7 +318,8 @@ static av_always_inline void add_yblock(SnowContext *s, int sliced, slice_buffer
if(!sliced && !offset_dst) if(!sliced && !offset_dst)
dst -= src_x; dst -= src_x;
src_x=0; src_x=0;
}else if(src_x + b_w > w){ }
if(src_x + b_w > w){
b_w = w - src_x; b_w = w - src_x;
} }
if(src_y<0){ if(src_y<0){
...@@ -327,7 +328,8 @@ static av_always_inline void add_yblock(SnowContext *s, int sliced, slice_buffer ...@@ -327,7 +328,8 @@ static av_always_inline void add_yblock(SnowContext *s, int sliced, slice_buffer
if(!sliced && !offset_dst) if(!sliced && !offset_dst)
dst -= src_y*dst_stride; dst -= src_y*dst_stride;
src_y=0; src_y=0;
}else if(src_y + b_h> h){ }
if(src_y + b_h> h){
b_h = h - src_y; b_h = h - src_y;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment