1. ffmpeg
  2. Commit 11dfd1fa20fae31531a3c085cdcc00089dbcaa5f
Browse code

avcodec/utvideodec: fix assumtation that slice_height >= 1

Fixes out of array read
Fixes: asan_heap-oob_2573085_3783_utvideo_rgba_median.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7656c4c6e66f8a787d384f027ad824cc1677fda1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Michael Niedermayer authored on 2014/11/11 03:44:20
Showing 1 changed files
libavcodec/utvideodec.c
History View file @ 11dfd1f
... ... 
@@ -224,7 +224,7 @@ static void restore_median(uint8_t *src, int step, int stride,
224 224 
             A        = bsrc[i];
225 225 
         }
226 226 
         bsrc += stride;
227 
-        if (slice_height == 1)
227 
+        if (slice_height <= 1)
228 228 
             continue;
229 229 
         // second line - first element has top prediction, the rest uses median
230 230 
         C        = bsrc[-stride];
... ... 
@@ -284,7 +284,7 @@ static void restore_median_il(uint8_t *src, int step, int stride,
284 284 
             A                 = bsrc[stride + i];
285 285 
         }
286 286 
         bsrc += stride2;
287 
-        if (slice_height == 1)
287 
+        if (slice_height <= 1)
288 288 
             continue;
289 289 
         // second line - first element has top prediction, the rest uses median
290 290 
         C        = bsrc[-stride2];