1. ffmpeg
  2. Commit 4d8b82160dbc6b31c08894e4e8147411b6f6078a
Browse code

avcodec/utvideodec: fix assumtation that slice_height >= 1

Fixes out of array read
Fixes: asan_heap-oob_2573085_3783_utvideo_rgba_median.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7656c4c6e66f8a787d384f027ad824cc1677fda1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Michael Niedermayer authored on 2014/11/11 03:44:20
Showing 1 changed files
libavcodec/utvideodec.c
History View file @ 4d8b821
... ... 
@@ -222,7 +222,7 @@ static void restore_median(uint8_t *src, int step, int stride,
222 222 
             A        = bsrc[i];
223 223 
         }
224 224 
         bsrc += stride;
225 
-        if (slice_height == 1)
225 
+        if (slice_height <= 1)
226 226 
             continue;
227 227 
         // second line - first element has top prediction, the rest uses median
228 228 
         C        = bsrc[-stride];
... ... 
@@ -282,7 +282,7 @@ static void restore_median_il(uint8_t *src, int step, int stride,
282 282 
             A                 = bsrc[stride + i];
283 283 
         }
284 284 
         bsrc += stride2;
285 
-        if (slice_height == 1)
285 
+        if (slice_height <= 1)
286 286 
             continue;
287 287 
         // second line - first element has top prediction, the rest uses median
288 288 
         C        = bsrc[-stride2];