Module: libav
Branch: release/0.7
Commit: 50073e2395522b6e2b8698ff0dd06ffaf8cbf8ce
Author: Alex Converse <alex.conve...@gmail.com>
Committer: Reinhard Tartler <siret...@tauware.de>
Date: Wed May 2 12:08:03 2012 -0700
motionpixels: Clip YUV values after applying a gradient.
Prevents illegal reads on truncated and malformed input.
CC: libav-sta...@libav.org
(cherry picked from commit b5da848facd41169283d7bfe568b83bdfa7fc42e)
Signed-off-by: Reinhard Tartler <siret...@tauware.de>
(cherry picked from commit aaa6a666774eb02c351c84e80622a5c69e9b642e)
Signed-off-by: Reinhard Tartler <siret...@tauware.de>
---
libavcodec/motionpixels.c | 6 ++++++
1 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/libavcodec/motionpixels.c b/libavcodec/motionpixels.c
index 23433a1..fd37622 100644
--- a/libavcodec/motionpixels.c
+++ b/libavcodec/motionpixels.c
@@ -190,10 +190,13 @@ static void mp_decode_line(MotionPixelsContext *mp,
GetBitContext *gb, int y)
p = mp_get_yuv_from_rgb(mp, x - 1, y);
} else {
p.y += mp_gradient(mp, 0, mp_get_vlc(mp, gb));
+ p.y = av_clip(p.y, 0, 31);
if ((x & 3) == 0) {
if ((y & 3) == 0) {
p.v += mp_gradient(mp, 1, mp_get_vlc(mp, gb));
+ p.v = av_clip(p.v, -32, 31);
p.u += mp_gradient(mp, 2, mp_get_vlc(mp, gb));
+ p.u = av_clip(p.u, -32, 31);
mp->hpt[((y / 4) * mp->avctx->width + x) / 4] = p;
} else {
p.v = mp->hpt[((y / 4) * mp->avctx->width + x) / 4].v;
@@ -217,9 +220,12 @@ static void mp_decode_frame_helper(MotionPixelsContext
*mp, GetBitContext *gb)
p = mp_get_yuv_from_rgb(mp, 0, y);
} else {
p.y += mp_gradient(mp, 0, mp_get_vlc(mp, gb));
+ p.y = av_clip(p.y, 0, 31);
if ((y & 3) == 0) {
p.v += mp_gradient(mp, 1, mp_get_vlc(mp, gb));
+ p.v = av_clip(p.v, -32, 31);
p.u += mp_gradient(mp, 2, mp_get_vlc(mp, gb));
+ p.u = av_clip(p.u, -32, 31);
}
mp->vpt[y] = p;
mp_set_rgb_from_yuv(mp, 0, y, &p);
_______________________________________________
libav-commits mailing list
libav-commits@libav.org
https://lists.libav.org/mailman/listinfo/libav-commits
