Module: libav Branch: release/0.8 Commit: a27e0ed26307eec6b366eb225568bada8496adbd
Author: Michael Niedermayer <[email protected]> Committer: Diego Biurrun <[email protected]> Date: Tue Nov 12 16:11:42 2013 +0100 mpegvideo_motion: Handle edge emulation even without unrestricted_mv Fix out of bounds read. Bug-Id: 959 Found by: F4B3CD@STARLAB and Agostino Sarubbo Signed-off-by: Vittorio Giovara <[email protected]> (cherry picked from commit 136f55207521f0b03194ef5b55ba70f1635d6aee) (cherry picked from commit 7a1e60a834f75cc6c7cba02bb2a85edc355f50c0) Signed-off-by: Diego Biurrun <[email protected]> --- libavcodec/mpegvideo_common.h | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/libavcodec/mpegvideo_common.h b/libavcodec/mpegvideo_common.h index 763c319..be7f7a5 100644 --- a/libavcodec/mpegvideo_common.h +++ b/libavcodec/mpegvideo_common.h @@ -220,14 +220,12 @@ static inline int hpel_motion(MpegEncContext *s, dxy &= ~2; src += src_y * stride + src_x; - if(s->unrestricted_mv && (s->flags&CODEC_FLAG_EMU_EDGE)){ - if( (unsigned)src_x > FFMAX(h_edge_pos - (motion_x&1) - w, 0) - || (unsigned)src_y > FFMAX(v_edge_pos - (motion_y&1) - h, 0)){ - s->dsp.emulated_edge_mc(s->edge_emu_buffer, src, s->linesize, w+1, (h+1)<<field_based, - src_x, src_y<<field_based, h_edge_pos, s->v_edge_pos); - src= s->edge_emu_buffer; - emu=1; - } + if( (unsigned)src_x > FFMAX(h_edge_pos - (motion_x&1) - w, 0) + || (unsigned)src_y > FFMAX(v_edge_pos - (motion_y&1) - h, 0)){ + s->dsp.emulated_edge_mc(s->edge_emu_buffer, src, s->linesize, w+1, (h+1)<<field_based, + src_x, src_y<<field_based, h_edge_pos, s->v_edge_pos); + src= s->edge_emu_buffer; + emu=1; } if(field_select) src += s->linesize; _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
