virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-13 21:28:01 +02:00
Code Issues Releases Activity

truemotion1: make sure index does not go out of bounds

Browse Source 
Fixes invalid reads.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
This commit is contained in:
Anton Khirnov 2013-11-15 19:06:23 +01:00
parent ce9bba5340
commit c918e08b9c
1 changed files with 17 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
libavcodec/truemotion1.c
View File

@ -515,6 +515,15 @@ hres,vres,i,i%vres (0 < i < 4)
index = s->index_stream[index_stream_index++] * 4; \
}
#define INC_INDEX \
do { \
if (index >= 1023) { \
av_log(s->avctx, AV_LOG_ERROR, "Invalid index value.\n"); \
return; \
} \
index++; \
} while (0)
#define APPLY_C_PREDICTOR() \
predictor_pair = s->c_predictor_table[index]; \
horiz_pred += (predictor_pair >> 1); \
@ -527,10 +536,10 @@ hres,vres,i,i%vres (0 < i < 4)
if (predictor_pair & 1) \
GET_NEXT_INDEX() \
else \
index++; \
INC_INDEX; \
} \
} else \
index++;
INC_INDEX;
#define APPLY_C_PREDICTOR_24() \
predictor_pair = s->c_predictor_table[index]; \
@ -544,10 +553,10 @@ hres,vres,i,i%vres (0 < i < 4)
if (predictor_pair & 1) \
GET_NEXT_INDEX() \
else \
index++; \
INC_INDEX; \
} \
} else \
index++;
INC_INDEX;
#define APPLY_Y_PREDICTOR() \
@ -562,10 +571,10 @@ hres,vres,i,i%vres (0 < i < 4)
if (predictor_pair & 1) \
GET_NEXT_INDEX() \
else \
index++; \
INC_INDEX; \
} \
} else \
index++;
INC_INDEX;
#define APPLY_Y_PREDICTOR_24() \
predictor_pair = s->y_predictor_table[index]; \
@ -579,10 +588,10 @@ hres,vres,i,i%vres (0 < i < 4)
if (predictor_pair & 1) \
GET_NEXT_INDEX() \
else \
index++; \
INC_INDEX; \
} \
} else \
index++;
INC_INDEX;
#define OUTPUT_PIXEL_PAIR() \
*current_pixel_pair = *vert_pred + horiz_pred; \