Pascal Patry <[EMAIL PROTECTED]> added the comment:

I can confirm that both put_h264_chroma_mc4_mmx and put_h264_chroma_mc4_ssse3
are able to trigger an invalid read.

This file reproduce the problem at 3:02.
http://movies.apple.com/movies/sony_pictures/hancock/hancock-tlr2r_h480p.mov

When the invalid read happen, the chroma function is reading from the last
stride of the src buffer.

This workaround in "libavcodec/utils.c" will avoid the problem:
-            buf->base[i]= av_malloc(size[i]+16); //FIXME 16
+            buf->base[i]= av_malloc(size[i]+16+656); //FIXME 16

______________________________________________________
FFmpeg issue tracker <[EMAIL PROTECTED]>
<https://roundup.mplayerhq.hu/roundup/ffmpeg/issue327>
______________________________________________________

Reply via email to