Browse code
avcodec/utvideodec: Fix handling of slice_height=0
Fixes out of array accesses
Fixes: asan_heap-oob_25bcd7e_3783_cov_3553517262_utvideo_rgba_median.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3881606240953b9275a247a1c98a567f3c44890f)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Michael Niedermayer authored on 2014/12/17 04:45:31Showing 1 changed files
| ... | ... |
@@ -212,6 +212,8 @@ static void restore_median(uint8_t *src, int step, int stride, |
| 212 | 212 |
slice_height = ((((slice + 1) * height) / slices) & cmask) - |
| 213 | 213 |
slice_start; |
| 214 | 214 |
|
| 215 |
+ if (!slice_height) |
|
| 216 |
+ continue; |
|
| 215 | 217 |
bsrc = src + slice_start * stride; |
| 216 | 218 |
|
| 217 | 219 |
// first line - left neighbour prediction |
| ... | ... |
@@ -267,6 +269,8 @@ static void restore_median_il(uint8_t *src, int step, int stride, |
| 267 | 267 |
slice_height = ((((slice + 1) * height) / slices) & cmask) - |
| 268 | 268 |
slice_start; |
| 269 | 269 |
slice_height >>= 1; |
| 270 |
+ if (!slice_height) |
|
| 271 |
+ continue; |
|
| 270 | 272 |
|
| 271 | 273 |
bsrc = src + slice_start * stride; |
| 272 | 274 |
|