avcodec/utvideodec: Fix handling of slice_height=0
authorMichael Niedermayer <michaelni@gmx.at>
Tue, 16 Dec 2014 19:45:31 +0000 (20:45 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Tue, 16 Dec 2014 22:00:04 +0000 (23:00 +0100)
Fixes out of array accesses
Fixes: asan_heap-oob_25bcd7e_3783_cov_3553517262_utvideo_rgba_median.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/utvideodec.c

index b565c10..3a3c46e 100644 (file)
@@ -215,6 +215,8 @@ static void restore_median(uint8_t *src, int step, int stride,
         slice_height = ((((slice + 1) * height) / slices) & cmask) -
                        slice_start;
 
         slice_height = ((((slice + 1) * height) / slices) & cmask) -
                        slice_start;
 
+        if (!slice_height)
+            continue;
         bsrc = src + slice_start * stride;
 
         // first line - left neighbour prediction
         bsrc = src + slice_start * stride;
 
         // first line - left neighbour prediction
@@ -270,6 +272,8 @@ static void restore_median_il(uint8_t *src, int step, int stride,
         slice_height   = ((((slice + 1) * height) / slices) & cmask) -
                          slice_start;
         slice_height >>= 1;
         slice_height   = ((((slice + 1) * height) / slices) & cmask) -
                          slice_start;
         slice_height >>= 1;
+        if (!slice_height)
+            continue;
 
         bsrc = src + slice_start * stride;
 
 
         bsrc = src + slice_start * stride;