Commit 76e6b1eb authored by Michael Niedermayer's avatar Michael Niedermayer

wmv2: Use emu edge mode when the edge is too small

Fixes out of array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 92002db3
...@@ -116,7 +116,7 @@ void ff_mspel_motion(MpegEncContext *s, ...@@ -116,7 +116,7 @@ void ff_mspel_motion(MpegEncContext *s,
uvlinesize = s->uvlinesize; uvlinesize = s->uvlinesize;
ptr = ref_picture[0] + (src_y * linesize) + src_x; ptr = ref_picture[0] + (src_y * linesize) + src_x;
if(s->flags&CODEC_FLAG_EMU_EDGE){ if(s->flags&CODEC_FLAG_EMU_EDGE || src_y <= -15 || src_y >= s->height - 1)
if(src_x<1 || src_y<1 || src_x + 17 >= s->h_edge_pos if(src_x<1 || src_y<1 || src_x + 17 >= s->h_edge_pos
|| src_y + h+1 >= v_edge_pos){ || src_y + h+1 >= v_edge_pos){
s->vdsp.emulated_edge_mc(s->edge_emu_buffer, ptr - 1 - s->linesize, s->linesize, 19, 19, s->vdsp.emulated_edge_mc(s->edge_emu_buffer, ptr - 1 - s->linesize, s->linesize, 19, 19,
...@@ -124,7 +124,6 @@ void ff_mspel_motion(MpegEncContext *s, ...@@ -124,7 +124,6 @@ void ff_mspel_motion(MpegEncContext *s,
ptr= s->edge_emu_buffer + 1 + s->linesize; ptr= s->edge_emu_buffer + 1 + s->linesize;
emu=1; emu=1;
} }
}
s->dsp.put_mspel_pixels_tab[dxy](dest_y , ptr , linesize); s->dsp.put_mspel_pixels_tab[dxy](dest_y , ptr , linesize);
s->dsp.put_mspel_pixels_tab[dxy](dest_y+8 , ptr+8 , linesize); s->dsp.put_mspel_pixels_tab[dxy](dest_y+8 , ptr+8 , linesize);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment