diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2021-11-11 15:29:05 +0300 |
|---|---|---|
| committer | Ronald S. Bultje <rsbultje@gmail.com> | 2021-11-11 15:29:05 +0300 |
| commit | c7a5b900017d379d62a242d8ef884eeb48862a27 (patch) | |
| tree | 3a427024d21651ba6ae01502df66e5e774bf6cbe /src/decode.c | |
| parent | 0930f1b1b8e463b2e9073cfb0fd0d89ab7f9402c (diff) | |
Fix wrong assignment if stride or sbh change, but stride * sbh don't
Credit to oss-fuzz.
Diffstat (limited to 'src/decode.c')
| -rw-r--r-- | src/decode.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/decode.c b/src/decode.c index 0f1c946..0081fe7 100644 --- a/src/decode.c +++ b/src/decode.c @@ -3060,7 +3060,8 @@ int dav1d_decode_frame_init(Dav1dFrameContext *const f) { const int need_cdef_lpf_copy = c->n_tc > 1 && has_resize; if (y_stride * f->sbh * 4 != f->lf.cdef_buf_plane_sz[0] || uv_stride * f->sbh * 8 != f->lf.cdef_buf_plane_sz[1] || - need_cdef_lpf_copy != f->lf.need_cdef_lpf_copy) + need_cdef_lpf_copy != f->lf.need_cdef_lpf_copy || + f->sbh != f->lf.cdef_buf_sbh) { dav1d_free_aligned(f->lf.cdef_line_buf); size_t alloc_sz = 64; @@ -3112,6 +3113,7 @@ int dav1d_decode_frame_init(Dav1dFrameContext *const f) { f->lf.cdef_buf_plane_sz[0] = (int) y_stride * f->sbh * 4; f->lf.cdef_buf_plane_sz[1] = (int) uv_stride * f->sbh * 8; f->lf.need_cdef_lpf_copy = need_cdef_lpf_copy; + f->lf.cdef_buf_sbh = f->sbh; } const int sb128 = f->seq_hdr->sb128; |