avcodec/utvideodec: fix assumtation that slice_height >= 1
authorMichael Niedermayer <michaelni@gmx.at>
Mon, 10 Nov 2014 18:44:20 +0000 (19:44 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Tue, 6 Jan 2015 17:25:50 +0000 (18:25 +0100)
Fixes out of array read
Fixes: asan_heap-oob_2573085_3783_utvideo_rgba_median.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7656c4c6e66f8a787d384f027ad824cc1677fda1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/utvideodec.c

index afd56ea..05c943f 100644 (file)
@@ -224,7 +224,7 @@ static void restore_median(uint8_t *src, int step, int stride,
             A        = bsrc[i];
         }
         bsrc += stride;
-        if (slice_height == 1)
+        if (slice_height <= 1)
             continue;
         // second line - first element has top prediction, the rest uses median
         C        = bsrc[-stride];
@@ -284,7 +284,7 @@ static void restore_median_il(uint8_t *src, int step, int stride,
             A                 = bsrc[stride + i];
         }
         bsrc += stride2;
-        if (slice_height == 1)
+        if (slice_height <= 1)
             continue;
         // second line - first element has top prediction, the rest uses median
         C        = bsrc[-stride2];