From 5e8b482752388fec0e1765ccf941b89c47a5fafe Mon Sep 17 00:00:00 2001 From: Di Wu Date: Wed, 15 Oct 2014 19:18:41 +0800 Subject: [PATCH] wmv2: Limit the mvx and mvy to be integer in some condition In the Luma MC process, when src_x is equal to s->width-1, then the prediction values are derived from {ref[src_y*linesize+width-2], ref[src_y*linesize+width-1]...ref[src_y*linesize+width+16]} if mvx is not a integer. ref[src_y*linesize+width+16] is the next line pixel because EDGE_WIDTH is equal to 16. Obviously the getted prediction value will be incorrect in this condition, even segment fault may occur. So mvx should be limited to be a integer when src_x is larger than s->width-2. Similar, mvy also should be limited to be a integer when src_y is larger than s->height-2. Signed-off-by: Di Wu --- libavcodec/wmv2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/wmv2.c b/libavcodec/wmv2.c index d102f36..17f9a1b 100644 --- a/libavcodec/wmv2.c +++ b/libavcodec/wmv2.c @@ -116,9 +116,9 @@ void ff_mspel_motion(MpegEncContext *s, uint8_t *dest_y, src_x = av_clip(src_x, -16, s->width); src_y = av_clip(src_y, -16, s->height); - if (src_x <= -16 || src_x >= s->width) + if (src_x <= -16 || src_x >= s->width - 1) dxy &= ~3; - if (src_y <= -16 || src_y >= s->height) + if (src_y <= -16 || src_y >= s->height - 1) dxy &= ~4; linesize = s->linesize; -- 1.7.9.5