[FFmpeg-cvslog] wmv2: Use emu edge mode when the edge is too small

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Thu Mar 28 21:49:45 2013 +0100| [76e6b1eba1feb5fc9d2ee70962914faff0228db2] | committer: Michael Niedermayer

wmv2: Use emu edge mode when the edge is too small

Fixes out of array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=76e6b1eba1feb5fc9d2ee70962914faff0228db2
---

 libavcodec/wmv2.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/libavcodec/wmv2.c b/libavcodec/wmv2.c
index 6676652..b5d0512 100644
--- a/libavcodec/wmv2.c
+++ b/libavcodec/wmv2.c
@@ -116,7 +116,7 @@ void ff_mspel_motion(MpegEncContext *s,
     uvlinesize = s->uvlinesize;
     ptr = ref_picture[0] + (src_y * linesize) + src_x;
 
-    if(s->flags&CODEC_FLAG_EMU_EDGE){
+    if(s->flags&CODEC_FLAG_EMU_EDGE || src_y <= -15 || src_y >= s->height - 1)
         if(src_x<1 || src_y<1 || src_x + 17  >= s->h_edge_pos
                               || src_y + h+1 >= v_edge_pos){
             s->vdsp.emulated_edge_mc(s->edge_emu_buffer, ptr - 1 - s->linesize, s->linesize, 19, 19,
@@ -124,7 +124,6 @@ void ff_mspel_motion(MpegEncContext *s,
             ptr= s->edge_emu_buffer + 1 + s->linesize;
             emu=1;
         }
-    }
 
     s->dsp.put_mspel_pixels_tab[dxy](dest_y             , ptr             , linesize);
     s->dsp.put_mspel_pixels_tab[dxy](dest_y+8           , ptr+8           , linesize);