Commit ad3b6fa7 authored by Michael Niedermayer's avatar Michael Niedermayer

swscale/swscale_unscaled: Fix odd height inputs for bayer_to_rgb24_wrapper()

Fixes: 372d2df1f04b49e25f109f07f90b1505/asan_heap-oob_2835d2e_8501_99e0114d7ba3a6db885d0b4684d200c1.cine
Fixes out of array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 7a0361b0
...@@ -1059,6 +1059,8 @@ static int bayer_to_rgb24_wrapper(SwsContext *c, const uint8_t* src[], int srcSt ...@@ -1059,6 +1059,8 @@ static int bayer_to_rgb24_wrapper(SwsContext *c, const uint8_t* src[], int srcSt
default: return 0; default: return 0;
} }
av_assert0(srcSliceH > 1);
copy(srcPtr, srcStride[0], dstPtr, dstStride[0], c->srcW); copy(srcPtr, srcStride[0], dstPtr, dstStride[0], c->srcW);
srcPtr += 2 * srcStride[0]; srcPtr += 2 * srcStride[0];
dstPtr += 2 * dstStride[0]; dstPtr += 2 * dstStride[0];
...@@ -1069,7 +1071,10 @@ static int bayer_to_rgb24_wrapper(SwsContext *c, const uint8_t* src[], int srcSt ...@@ -1069,7 +1071,10 @@ static int bayer_to_rgb24_wrapper(SwsContext *c, const uint8_t* src[], int srcSt
dstPtr += 2 * dstStride[0]; dstPtr += 2 * dstStride[0];
} }
copy(srcPtr, srcStride[0], dstPtr, dstStride[0], c->srcW); if (i + 1 == srcSliceH) {
copy(srcPtr, -srcStride[0], dstPtr, -dstStride[0], c->srcW);
} else if (i < srcSliceH)
copy(srcPtr, srcStride[0], dstPtr, dstStride[0], c->srcW);
return srcSliceH; return srcSliceH;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment