comparison h264.c @ 2383:3c2abf00b7c1 libavcodec

out of buffer access fix
author michael
date Thu, 09 Dec 2004 01:01:11 +0000
parents 26560d4fdb1f
children 6ffcdd96ae99
comparison
equal deleted inserted replaced
2382:23e7af611c34 2383:3c2abf00b7c1
2399 2399
2400 if(IS_INTRA4x4(mb_type)){ 2400 if(IS_INTRA4x4(mb_type)){
2401 if(!s->encoding){ 2401 if(!s->encoding){
2402 for(i=0; i<16; i++){ 2402 for(i=0; i<16; i++){
2403 uint8_t * const ptr= dest_y + h->block_offset[i]; 2403 uint8_t * const ptr= dest_y + h->block_offset[i];
2404 uint8_t *topright= ptr + 4 - linesize; 2404 uint8_t *topright;
2405 const int topright_avail= (h->topright_samples_available<<i)&0x8000;
2406 const int dir= h->intra4x4_pred_mode_cache[ scan8[i] ]; 2405 const int dir= h->intra4x4_pred_mode_cache[ scan8[i] ];
2407 int tr; 2406 int tr;
2408 2407
2409 if(!topright_avail){ 2408 if(dir == DIAG_DOWN_LEFT_PRED || dir == VERT_LEFT_PRED){
2410 tr= ptr[3 - linesize]*0x01010101; 2409 const int topright_avail= (h->topright_samples_available<<i)&0x8000;
2411 topright= (uint8_t*) &tr; 2410 assert(mb_y || linesize <= h->block_offset[i]);
2412 }else if(i==5 && h->deblocking_filter){ 2411 if(!topright_avail){
2413 tr= *(uint32_t*)h->top_border[mb_x+1]; 2412 tr= ptr[3 - linesize]*0x01010101;
2414 topright= (uint8_t*) &tr; 2413 topright= (uint8_t*) &tr;
2415 } 2414 }else if(i==5 && h->deblocking_filter){
2415 tr= *(uint32_t*)h->top_border[mb_x+1];
2416 topright= (uint8_t*) &tr;
2417 }else
2418 topright= ptr + 4 - linesize;
2419 }else
2420 topright= NULL;
2416 2421
2417 h->pred4x4[ dir ](ptr, topright, linesize); 2422 h->pred4x4[ dir ](ptr, topright, linesize);
2418 if(h->non_zero_count_cache[ scan8[i] ]){ 2423 if(h->non_zero_count_cache[ scan8[i] ]){
2419 if(s->codec_id == CODEC_ID_H264) 2424 if(s->codec_id == CODEC_ID_H264)
2420 s->dsp.h264_idct_add(ptr, h->mb + i*16, linesize); 2425 s->dsp.h264_idct_add(ptr, h->mb + i*16, linesize);