This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.1 in repository ffmpeg.
commit 8c2e27e7bc852589018a2e07128e82db41011722 Author: Michael Niedermayer <[email protected]> AuthorDate: Wed Jun 17 01:17:28 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Wed Jun 17 04:08:30 2026 +0200 avcodec/snowenc: fix out-of-bounds OBMC read in get_dc() for narrow planes Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 30c6667dadb085a2c1b9a7b7fe859f758de7044c) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/snowenc.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/libavcodec/snowenc.c b/libavcodec/snowenc.c index a30a895200..94a592f69b 100644 --- a/libavcodec/snowenc.c +++ b/libavcodec/snowenc.c @@ -705,13 +705,15 @@ static int get_dc(SnowEncContext *enc, int mb_x, int mb_y, int plane_index) for(y2= FFMAX(y, 0); y2<FFMIN(h, y+block_h); y2++){ for(x2= FFMAX(x, 0); x2<FFMIN(w, x+block_w); x2++){ - int index= x2-(block_w*mb_x - block_w/2) + (y2-(block_h*mb_y - block_h/2))*obmc_stride; + int col= x2-(block_w*mb_x - block_w/2); + int row= y2-(block_h*mb_y - block_h/2); + int index= col + row*obmc_stride; int obmc_v= obmc[index]; int d; - if(y<0) obmc_v += obmc[index + block_h*obmc_stride]; - if(x<0) obmc_v += obmc[index + block_w]; - if(y+block_h>h) obmc_v += obmc[index - block_h*obmc_stride]; - if(x+block_w>w) obmc_v += obmc[index - block_w]; + if(y<0) obmc_v += obmc[index + block_h*obmc_stride]; + if(x<0) obmc_v += obmc[index + block_w]; + if(y+block_h>h && row-block_h >= 0) obmc_v += obmc[index - block_h*obmc_stride]; + if(x+block_w>w && col-block_w >= 0) obmc_v += obmc[index - block_w]; //FIXME precalculate this or simplify it somehow else d = -dst[index] + (1<<(FRAC_BITS-1)); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
