hevc: fix incorrect sao buffer size
authorChristophe Gisquet <christophe.gisquet@gmail.com>
Sun, 10 Aug 2014 09:43:12 +0000 (11:43 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sun, 10 Aug 2014 10:34:57 +0000 (12:34 +0200)
It previously used the output, cropped size, causing overreads/writes.

Fixes ticket #3839.

This issue was introduced by d249e682, which is not part of any release

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/hevc.c

index 1972a5b..3272485 100644 (file)
@@ -280,16 +280,16 @@ static int get_buffer_sao(HEVCContext *s, AVFrame *frame, const HEVCSPS *sps)
 {
     int ret, i;
 
-    frame->width  = s->avctx->width  + 2;
-    frame->height = s->avctx->height + 2;
+    frame->width  = s->avctx->coded_width  + 2;
+    frame->height = s->avctx->coded_height + 2;
     if ((ret = ff_get_buffer(s->avctx, frame, AV_GET_BUFFER_FLAG_REF)) < 0)
         return ret;
     for (i = 0; frame->data[i]; i++) {
         int offset = frame->linesize[i] + (1 << sps->pixel_shift);
         frame->data[i] += offset;
     }
-    frame->width  = s->avctx->width;
-    frame->height = s->avctx->height;
+    frame->width  = s->avctx->coded_width;
+    frame->height = s->avctx->coded_height;
 
     return 0;
 }