[FFmpeg-cvslog] lavfi/select/scene: fix potential overread.

[Clément Bœsch]

ffmpeg | branch: master | Clément Bœsch <ubitux at gmail.com> | Sat Oct 13 18:19:29 2012 +0200| [0852648301ad968bc7d79d000400e2b973bbb59a] | committer: Clément Bœsch

lavfi/select/scene: fix potential overread.

Also make sure we use the actual width of the image and not the whole
linesize.

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0852648301ad968bc7d79d000400e2b973bbb59a
---

 libavfilter/vf_select.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/libavfilter/vf_select.c b/libavfilter/vf_select.c
index c600024..b0c3cb2 100644
--- a/libavfilter/vf_select.c
+++ b/libavfilter/vf_select.c
@@ -204,21 +204,24 @@ static double get_scene_score(AVFilterContext *ctx, AVFilterBufferRef *picref)
         picref->video->h    == prev_picref->video->h &&
         picref->video->w    == prev_picref->video->w &&
         picref->linesize[0] == prev_picref->linesize[0]) {
-        int x, y;
+        int x, y, nb_sad = 0;
         int64_t sad = 0;
         double mafd, diff;
         uint8_t *p1 =      picref->data[0];
         uint8_t *p2 = prev_picref->data[0];
         const int linesize = picref->linesize[0];
 
-        for (y = 0; y < picref->video->h; y += 8)
-            for (x = 0; x < linesize; x += 8)
+        for (y = 0; y < picref->video->h - 8; y += 8) {
+            for (x = 0; x < picref->video->w*3 - 8; x += 8) {
                 sad += select->c.sad[1](select,
                                         p1 + y * linesize + x,
                                         p2 + y * linesize + x,
                                         linesize, 8);
+                nb_sad += 8 * 8;
+            }
+        }
         emms_c();
-        mafd = sad / (picref->video->h * picref->video->w * 3);
+        mafd = nb_sad ? sad / nb_sad : 0;
         diff = fabs(mafd - select->prev_mafd);
         ret  = av_clipf(FFMIN(mafd, diff) / 100., 0, 1);
         select->prev_mafd = mafd;