Mercurial > libavcodec.hg
changeset 2383:3c2abf00b7c1 libavcodec
out of buffer access fix
| author | michael |
|---|---|
| date | Thu, 09 Dec 2004 01:01:11 +0000 |
| parents | 23e7af611c34 |
| children | 6ffcdd96ae99 |
| files | h264.c |
| diffstat | 1 files changed, 14 insertions(+), 9 deletions(-) [+] |
line wrap: on
line diff
--- a/h264.c Wed Dec 08 18:02:56 2004 +0000 +++ b/h264.c Thu Dec 09 01:01:11 2004 +0000 @@ -2401,18 +2401,23 @@ if(!s->encoding){ for(i=0; i<16; i++){ uint8_t * const ptr= dest_y + h->block_offset[i]; - uint8_t *topright= ptr + 4 - linesize; - const int topright_avail= (h->topright_samples_available<<i)&0x8000; + uint8_t *topright; const int dir= h->intra4x4_pred_mode_cache[ scan8[i] ]; int tr; - if(!topright_avail){ - tr= ptr[3 - linesize]*0x01010101; - topright= (uint8_t*) &tr; - }else if(i==5 && h->deblocking_filter){ - tr= *(uint32_t*)h->top_border[mb_x+1]; - topright= (uint8_t*) &tr; - } + if(dir == DIAG_DOWN_LEFT_PRED || dir == VERT_LEFT_PRED){ + const int topright_avail= (h->topright_samples_available<<i)&0x8000; + assert(mb_y || linesize <= h->block_offset[i]); + if(!topright_avail){ + tr= ptr[3 - linesize]*0x01010101; + topright= (uint8_t*) &tr; + }else if(i==5 && h->deblocking_filter){ + tr= *(uint32_t*)h->top_border[mb_x+1]; + topright= (uint8_t*) &tr; + }else + topright= ptr + 4 - linesize; + }else + topright= NULL; h->pred4x4[ dir ](ptr, topright, linesize); if(h->non_zero_count_cache[ scan8[i] ]){