From: Michael Niedermayer <[email protected]> Fixes overread
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/vc1dec.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c index 51124cf..b76fc76 100644 --- a/libavcodec/vc1dec.c +++ b/libavcodec/vc1dec.c @@ -4946,7 +4946,7 @@ static void vc1_draw_sprites(VC1Context *v, SpriteData* sd) if (!(xoff[sprite] & 0xFFFF) && xadv[sprite] == 1 << 16) { src_h[sprite][0] = iplane + (xoff[sprite] >> 16) + yline * iline; if (ysub[sprite]) - src_h[sprite][1] = iplane + (xoff[sprite] >> 16) + (yline + 1) * iline; + src_h[sprite][1] = iplane + (xoff[sprite] >> 16) + FFMIN(yline + 1, (v->sprite_height>>!!plane)-1) * iline; } else { if (sr_cache[sprite][0] != yline) { if (sr_cache[sprite][1] == yline) { @@ -4958,7 +4958,7 @@ static void vc1_draw_sprites(VC1Context *v, SpriteData* sd) } } if (ysub[sprite] && sr_cache[sprite][1] != yline + 1) { - v->vc1dsp.sprite_h(v->sr_rows[sprite][1], iplane + (yline + 1) * iline, xoff[sprite], xadv[sprite], width); + v->vc1dsp.sprite_h(v->sr_rows[sprite][1], iplane + FFMIN(yline + 1, (v->sprite_height>>!!plane)-1) * iline, xoff[sprite], xadv[sprite], width); sr_cache[sprite][1] = yline + 1; } src_h[sprite][0] = v->sr_rows[sprite][0]; -- 1.7.4 _______________________________________________ libav-devel mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-devel
