diff options
| author | Paul B Mahol <onemda@gmail.com> | 2017-02-24 15:27:19 +0100 |
|---|---|---|
| committer | Paul B Mahol <onemda@gmail.com> | 2017-02-24 15:27:19 +0100 |
| commit | 0a28c505063f0fdbfa24c28dc1e67704e10127b5 (patch) | |
| tree | 34d6be0455dcc3f132a11ce19a80897ca89c7222 /libavcodec/scpr.c | |
| parent | c87ea47481d35b0219e2e22d60f2a431286f725d (diff) | |
| download | ffmpeg-0a28c505063f0fdbfa24c28dc1e67704e10127b5.tar.gz | |
avcodec/scpr: improve motion vectors checking for out of buffer write
Signed-off-by: Paul B Mahol <onemda@gmail.com>
Diffstat (limited to 'libavcodec/scpr.c')
| -rw-r--r-- | libavcodec/scpr.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/scpr.c b/libavcodec/scpr.c index 0802dd4d70..75e8ffab32 100644 --- a/libavcodec/scpr.c +++ b/libavcodec/scpr.c @@ -509,8 +509,8 @@ static int decompress_p(AVCodecContext *avctx, by + mvy + sy1 >= avctx->height || bx + mvx + sx1 >= avctx->width) return AVERROR_INVALIDDATA; - for (i = 0; i < sy2 - sy1 && (by + sy1 + i) < avctx->height; i++) { - for (j = 0; j < sx2 - sx1 && (bx + sx1 + j) < avctx->width; j++) { + for (i = 0; i < sy2 - sy1 && (by + sy1 + i) < avctx->height && (by + mvy + sy1 + i) < avctx->height; i++) { + for (j = 0; j < sx2 - sx1 && (bx + sx1 + j) < avctx->width && (bx + mvx + sx1 + j) < avctx->width; j++) { dst[(by + i + sy1) * linesize + bx + sx1 + j] = prev[(by + mvy + sy1 + i) * plinesize + bx + sx1 + mvx + j]; } } |