diracdec: fix emulated_edge condition, fix out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-12-07 00:27:08 +01:00
parent f8d68822c0
commit b84d1bf193

View File

@ -1409,8 +1409,9 @@ static int mc_subpel(DiracContext *s, DiracBlock *block, const uint8_t *src[5],
} }
/* fixme: v/h _edge_pos */ /* fixme: v/h _edge_pos */
if ((unsigned)x > FFMAX(p->width +EDGE_WIDTH/2 - p->xblen, 0) || if (x + p->xblen > p->width +EDGE_WIDTH/2 ||
(unsigned)y > FFMAX(p->height+EDGE_WIDTH/2 - p->yblen, 0)) { y + p->yblen > p->height+EDGE_WIDTH/2 ||
x < 0 || y < 0) {
for (i = 0; i < nplanes; i++) { for (i = 0; i < nplanes; i++) {
ff_emulated_edge_mc(s->edge_emu_buffer[i], src[i], p->stride, ff_emulated_edge_mc(s->edge_emu_buffer[i], src[i], p->stride,
p->xblen, p->yblen, x, y, p->xblen, p->yblen, x, y,