In planarCopyWrapper, Only copy length, not stride of the last line in the plane
authorMartin Storsjö <martin@martin.st>
Fri, 16 Jul 2010 17:45:50 +0000 (17:45 +0000)
committerMartin Storsjö <martin@martin.st>
Fri, 16 Jul 2010 17:45:50 +0000 (17:45 +0000)
If the destination planes are offset within the destination buffer,
writing the extra bytes at the end may write outside of the destination
buffer.

Originally committed as revision 31746 to svn://svn.mplayerhq.hu/mplayer/trunk/libswscale

libswscale/swscale.c

index 159bf9c..b589131 100644 (file)
@@ -1663,9 +1663,11 @@ static int planarCopyWrapper(SwsContext *c, const uint8_t* src[], int srcStride[
                     srcPtr+= srcStride[plane];
                     dstPtr+= dstStride[plane];
                 }
-            } else if (dstStride[plane]==srcStride[plane] && srcStride[plane] > 0)
-                memcpy(dst[plane] + dstStride[plane]*y, src[plane], height*dstStride[plane]);
-            else {
+            } else if (dstStride[plane]==srcStride[plane] && srcStride[plane] > 0) {
+                if (height > 0)
+                    memcpy(dst[plane] + dstStride[plane]*y, src[plane],
+                           (height - 1)*dstStride[plane] + length);
+            } else {
                 if(is16BPS(c->srcFormat) && is16BPS(c->dstFormat))
                     length*=2;
                 for (i=0; i<height; i++) {