diff options
| author | Paul B Mahol <onemda@gmail.com> | 2022-11-13 01:03:22 +0300 |
|---|---|---|
| committer | Paul B Mahol <onemda@gmail.com> | 2022-11-13 02:19:57 +0300 |
| commit | 163f1949ed1eac8598737ba0e917449f20ef2b2d (patch) | |
| tree | aa886e3c7d96f541467950a27f81dce14be3e244 | |
| parent | 31e1b614f683940ffe6c1fd0f33f658b3e7c845f (diff) | |
avcodec/smcenc: more y<height checks to fix invalid reads
| -rw-r--r-- | libavcodec/smcenc.c | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/libavcodec/smcenc.c b/libavcodec/smcenc.c index 33549b8ab4..59b9d9e0ff 100644 --- a/libavcodec/smcenc.c +++ b/libavcodec/smcenc.c @@ -302,11 +302,12 @@ static void smc_encode_stream(SMCContext *s, const AVFrame *frame, } for (int i = 0; i < blocks; i++) { + const int y_size = FFMIN(4, height - cur_y); uint8_t value = s->color_pairs[color_table_index][1]; uint16_t flags = 0; int shift = 15; - for (int y = 0; y < 4; y++) { + for (int y = 0; y < y_size; y++) { for (int x = 0; x < 4; x++) { flags |= (value == pixel_ptr[x + y * stride]) << shift; shift--; @@ -350,6 +351,7 @@ static void smc_encode_stream(SMCContext *s, const AVFrame *frame, } for (int i = 0; i < blocks; i++) { + const int y_size = FFMIN(4, height - cur_y); uint32_t flags = 0; uint8_t quad[4]; int shift = 30; @@ -357,7 +359,7 @@ static void smc_encode_stream(SMCContext *s, const AVFrame *frame, for (int k = 0; k < 4; k++) quad[k] = s->color_quads[color_table_index][k]; - for (int y = 0; y < 4; y++) { + for (int y = 0; y < y_size; y++) { for (int x = 0; x < 4; x++) { int pixel = pixel_ptr[x + y * stride]; uint32_t idx = 0; @@ -417,6 +419,7 @@ static void smc_encode_stream(SMCContext *s, const AVFrame *frame, } for (int i = 0; i < blocks; i++) { + const int y_size = FFMIN(4, height - cur_y); uint64_t flags = 0; uint8_t octet[8]; int shift = 45; @@ -424,7 +427,7 @@ static void smc_encode_stream(SMCContext *s, const AVFrame *frame, for (int k = 0; k < 8; k++) octet[k] = s->color_octets[color_table_index][k]; - for (int y = 0; y < 4; y++) { + for (int y = 0; y < y_size; y++) { for (int x = 0; x < 4; x++) { int pixel = pixel_ptr[x + y * stride]; uint64_t idx = 0; @@ -451,11 +454,17 @@ static void smc_encode_stream(SMCContext *s, const AVFrame *frame, default: bytestream2_put_byte(pb, 0xE0 | (blocks - 1)); for (int i = 0; i < blocks; i++) { - for (int y = 0; y < 4; y++) { + const int y_size = FFMIN(4, height - cur_y); + for (int y = 0; y < y_size; y++) { for (int x = 0; x < 4; x++) bytestream2_put_byte(pb, pixel_ptr[x + y * stride]); } + for (int y = y_size; y < 4; y++) { + for (int x = 0; x < 4; x++) + bytestream2_put_byte(pb, 0); + } + ADVANCE_BLOCK(pixel_ptr, row_ptr, 1) } break; |