virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

tiffenc: fix out of array read

Browse Source 
Fixes ticket1112

Found-by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-05-12 10:57:15 +02:00
parent 3b5632479e
commit d04956344d
1 changed files with 18 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
libavcodec/tiffenc.c
View File

@ -193,13 +193,24 @@ static void pack_yuv(TiffEncoderContext * s, uint8_t * dst, int lnum)
int w = (s->width - 1) / s->subsampling[0] + 1;
uint8_t *pu = &p->data[1][lnum / s->subsampling[1] * p->linesize[1]];
uint8_t *pv = &p->data[2][lnum / s->subsampling[1] * p->linesize[2]];
for (i = 0; i < w; i++){
for (j = 0; j < s->subsampling[1]; j++)
for (k = 0; k < s->subsampling[0]; k++)
*dst++ = p->data[0][(lnum + j) * p->linesize[0] +
i * s->subsampling[0] + k];
*dst++ = *pu++;
*dst++ = *pv++;
if(s->width % s->subsampling[0] || s->height % s->subsampling[1]){
for (i = 0; i < w; i++){
for (j = 0; j < s->subsampling[1]; j++)
for (k = 0; k < s->subsampling[0]; k++)
*dst++ = p->data[0][FFMIN(lnum + j, s->height-1) * p->linesize[0] +
FFMIN(i * s->subsampling[0] + k, s->width-1)];
*dst++ = *pu++;
*dst++ = *pv++;
}
}else{
for (i = 0; i < w; i++){
for (j = 0; j < s->subsampling[1]; j++)
for (k = 0; k < s->subsampling[0]; k++)
*dst++ = p->data[0][(lnum + j) * p->linesize[0] +
i * s->subsampling[0] + k];
*dst++ = *pu++;
*dst++ = *pv++;
}
}
}