[FFmpeg-cvslog] avcodec/mpegvideo_motion: Fix gmc chroma dimensions
Michael Niedermayer
git at videolan.org
Thu Feb 12 18:11:56 CET 2015
ffmpeg | branch: release/2.5 | Michael Niedermayer <michaelni at gmx.at> | Wed Feb 4 22:30:08 2015 +0100| [c65a731b6f603789a16cf5ac275b67d85c6d92a6] | committer: Michael Niedermayer
avcodec/mpegvideo_motion: Fix gmc chroma dimensions
Fixes integer overflow and out of array read
Fixes: asan_heap-oob_1fb2f9b_3780_cov_3984375136_usf.mkv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit fd52d2d3d1ee41822a9801dffd41c0e1a2db32a8)
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c65a731b6f603789a16cf5ac275b67d85c6d92a6
---
libavcodec/mpegvideo_motion.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/mpegvideo_motion.c b/libavcodec/mpegvideo_motion.c
index e7a585d..e320511 100644
--- a/libavcodec/mpegvideo_motion.c
+++ b/libavcodec/mpegvideo_motion.c
@@ -178,7 +178,7 @@ static void gmc_motion(MpegEncContext *s,
s->sprite_delta[0][0], s->sprite_delta[0][1],
s->sprite_delta[1][0], s->sprite_delta[1][1],
a + 1, (1 << (2 * a + 1)) - s->no_rounding,
- s->h_edge_pos >> 1, s->v_edge_pos >> 1);
+ (s->h_edge_pos + 1) >> 1, (s->v_edge_pos + 1) >> 1);
ptr = ref_picture[2];
s->mdsp.gmc(dest_cr, ptr, uvlinesize, 8,
@@ -186,7 +186,7 @@ static void gmc_motion(MpegEncContext *s,
s->sprite_delta[0][0], s->sprite_delta[0][1],
s->sprite_delta[1][0], s->sprite_delta[1][1],
a + 1, (1 << (2 * a + 1)) - s->no_rounding,
- s->h_edge_pos >> 1, s->v_edge_pos >> 1);
+ (s->h_edge_pos + 1) >> 1, (s->v_edge_pos + 1) >> 1);
}
static inline int hpel_motion(MpegEncContext *s,
More information about the ffmpeg-cvslog
mailing list