Fixes out of array access
Fixes: 0cf176e6d3ab9fe924f39738e513f547/asan_generic_4a54aa_3431_aaa28be1cb32e307a9890cad06f84fba.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7ec9c5ce8a753175244da971fed9f1e25aef7971)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
... | ... |
@@ -747,8 +747,7 @@ static int apng_encode_frame(AVCodecContext *avctx, const AVFrame *pict, |
747 | 747 |
|
748 | 748 |
// Do disposal |
749 | 749 |
if (last_fctl_chunk.dispose_op != APNG_DISPOSE_OP_PREVIOUS) { |
750 |
- memcpy(diffFrame->data[0], s->last_frame->data[0], |
|
751 |
- s->last_frame->linesize[0] * s->last_frame->height); |
|
750 |
+ av_frame_copy(diffFrame, s->last_frame); |
|
752 | 751 |
|
753 | 752 |
if (last_fctl_chunk.dispose_op == APNG_DISPOSE_OP_BACKGROUND) { |
754 | 753 |
for (y = last_fctl_chunk.y_offset; y < last_fctl_chunk.y_offset + last_fctl_chunk.height; ++y) { |
... | ... |
@@ -760,8 +759,7 @@ static int apng_encode_frame(AVCodecContext *avctx, const AVFrame *pict, |
760 | 760 |
if (!s->prev_frame) |
761 | 761 |
continue; |
762 | 762 |
|
763 |
- memcpy(diffFrame->data[0], s->prev_frame->data[0], |
|
764 |
- s->prev_frame->linesize[0] * s->prev_frame->height); |
|
763 |
+ av_frame_copy(diffFrame, s->prev_frame); |
|
765 | 764 |
} |
766 | 765 |
|
767 | 766 |
// Do inverse blending |
... | ... |
@@ -923,8 +921,7 @@ static int encode_apng(AVCodecContext *avctx, AVPacket *pkt, |
923 | 923 |
} |
924 | 924 |
|
925 | 925 |
// Do disposal, but not blending |
926 |
- memcpy(s->prev_frame->data[0], s->last_frame->data[0], |
|
927 |
- s->last_frame->linesize[0] * s->last_frame->height); |
|
926 |
+ av_frame_copy(s->prev_frame, s->last_frame); |
|
928 | 927 |
if (s->last_frame_fctl.dispose_op == APNG_DISPOSE_OP_BACKGROUND) { |
929 | 928 |
uint32_t y; |
930 | 929 |
uint8_t bpp = (s->bits_per_pixel + 7) >> 3; |