Browse code

Fix reading past the end of frame buffer.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Boris Maksalov authored on 2012/08/10 17:50:35
Showing 1 changed files
... ...
@@ -254,24 +254,24 @@ static void get_slice_data(ProresContext *ctx, const uint16_t *src,
254 254
             ctx->dsp.fdct(esrc, elinesize, blocks);
255 255
             blocks += 64;
256 256
             if (blocks_per_mb > 2) {
257
-                ctx->dsp.fdct(src + 8, linesize, blocks);
257
+                ctx->dsp.fdct(esrc + 8, elinesize, blocks);
258 258
                 blocks += 64;
259 259
             }
260
-            ctx->dsp.fdct(src + linesize * 4, linesize, blocks);
260
+            ctx->dsp.fdct(esrc + elinesize * 4, elinesize, blocks);
261 261
             blocks += 64;
262 262
             if (blocks_per_mb > 2) {
263
-                ctx->dsp.fdct(src + linesize * 4 + 8, linesize, blocks);
263
+                ctx->dsp.fdct(esrc + elinesize * 4 + 8, elinesize, blocks);
264 264
                 blocks += 64;
265 265
             }
266 266
         } else {
267 267
             ctx->dsp.fdct(esrc, elinesize, blocks);
268 268
             blocks += 64;
269
-            ctx->dsp.fdct(src + linesize * 4, linesize, blocks);
269
+            ctx->dsp.fdct(esrc + elinesize * 4, elinesize, blocks);
270 270
             blocks += 64;
271 271
             if (blocks_per_mb > 2) {
272
-                ctx->dsp.fdct(src + 8, linesize, blocks);
272
+                ctx->dsp.fdct(esrc + 8, elinesize, blocks);
273 273
                 blocks += 64;
274
-                ctx->dsp.fdct(src + linesize * 4 + 8, linesize, blocks);
274
+                ctx->dsp.fdct(esrc + elinesize * 4 + 8, elinesize, blocks);
275 275
                 blocks += 64;
276 276
             }
277 277
         }