When either video dimension is only one macroblock, subtractions
based on v_edge_pos and the macroblock size may be negative. In
that situation, an unsigned comparison isn't sufficent to test for
MV overruns, because a limit of (unsigned)-1 will let any other
value pass.
---
libavcodec/rv34.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/rv34.c b/libavcodec/rv34.c
index 295a633..2f6a17e 100644
--- a/libavcodec/rv34.c
+++ b/libavcodec/rv34.c
@@ -690,8 +690,8 @@ static inline void rv34_mc(RV34DecContext *r, const int
block_type,
srcY += src_y * s->linesize + src_x;
srcU += uvsrc_y * s->uvlinesize + uvsrc_x;
srcV += uvsrc_y * s->uvlinesize + uvsrc_x;
- if( (unsigned)(src_x - !!lx*2) > s->h_edge_pos - !!lx*2 - (width <<3) - 4
- || (unsigned)(src_y - !!ly*2) > s->v_edge_pos - !!ly*2 - (height<<3) -
4){
+ if( (unsigned)(src_x - !!lx*2) > FFMAX(s->h_edge_pos - !!lx*2 - (width
<<3) - 4, 0)
+ || (unsigned)(src_y - !!ly*2) > FFMAX(s->v_edge_pos - !!ly*2 -
(height<<3) - 4, 0)){
uint8_t *uvbuf = s->edge_emu_buffer + 22 * s->linesize;
srcY -= 2 + 2*s->linesize;
--
1.7.5.4
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
