From: Michael Niedermayer <[email protected]>
Fixes out of array accesses and integer overflows.
---
Squashed, as requested by Kostya.
Vittorio
libavcodec/dsputil.c | 4 ++--
libavcodec/pngdsp.c | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavcodec/dsputil.c b/libavcodec/dsputil.c
index fbdd5ad..65f72b1 100644
--- a/libavcodec/dsputil.c
+++ b/libavcodec/dsputil.c
@@ -1742,7 +1742,7 @@ void ff_set_cmp(DSPContext* c, me_cmp_func *cmp, int
type){
static void add_bytes_c(uint8_t *dst, uint8_t *src, int w){
long i;
- for(i=0; i<=w-sizeof(long); i+=sizeof(long)){
+ for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){
long a = *(long*)(src+i);
long b = *(long*)(dst+i);
*(long*)(dst+i) = ((a&pb_7f) + (b&pb_7f)) ^ ((a^b)&pb_80);
@@ -1767,7 +1767,7 @@ static void diff_bytes_c(uint8_t *dst, uint8_t *src1,
uint8_t *src2, int w){
}
}else
#endif
- for(i=0; i<=w-sizeof(long); i+=sizeof(long)){
+ for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){
long a = *(long*)(src1+i);
long b = *(long*)(src2+i);
*(long*)(dst+i) = ((a|pb_80) - (b&pb_7f)) ^ ((a^b^pb_80)&pb_80);
diff --git a/libavcodec/pngdsp.c b/libavcodec/pngdsp.c
index afd9093..5cc41c4 100644
--- a/libavcodec/pngdsp.c
+++ b/libavcodec/pngdsp.c
@@ -31,7 +31,7 @@
static void add_bytes_l2_c(uint8_t *dst, uint8_t *src1, uint8_t *src2, int w)
{
long i;
- for (i = 0; i <= w - sizeof(long); i += sizeof(long)) {
+ for (i = 0; i <= w - (int)sizeof(long); i += sizeof(long)) {
long a = *(long *)(src1 + i);
long b = *(long *)(src2 + i);
*(long *)(dst + i) = ((a & pb_7f) + (b & pb_7f)) ^ ((a ^ b) & pb_80);
--
1.7.9.5
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
