summaryrefslogtreecommitdiff
path: root/libavcodec/vc1.c
diff options
context:
space:
mode:
authorDavid Conrad <lessen42@gmail.com>2009-05-15 07:49:59 +0000
committerDavid Conrad <lessen42@gmail.com>2009-05-15 07:49:59 +0000
commitebcf3b742bcc71355ddc7c1a83bb829425a9f754 (patch)
tree6f5ef0cad5ce6d748a5ca33453ba1dbc1747c473 /libavcodec/vc1.c
parente1316b19ea1ada3e93734a6d22f2305cb0c3d49f (diff)
downloadffmpeg-ebcf3b742bcc71355ddc7c1a83bb829425a9f754.tar.gz
Ensure that we don't read from invalid memory with B-frame qpel
Originally committed as revision 18839 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/vc1.c')
-rw-r--r--libavcodec/vc1.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/vc1.c b/libavcodec/vc1.c
index 3a5b447667..82bf8db0de 100644
--- a/libavcodec/vc1.c
+++ b/libavcodec/vc1.c
@@ -1818,8 +1818,8 @@ static void vc1_interp_mc(VC1Context *v)
}
if(v->rangeredfrm
- || (unsigned)src_x > s->h_edge_pos - (mx&3) - 16
- || (unsigned)src_y > s->v_edge_pos - (my&3) - 16){
+ || (unsigned)src_x > s->h_edge_pos - (mx&3) - 16 - s->mspel*3
+ || (unsigned)src_y > s->v_edge_pos - (my&3) - 16 - s->mspel*3){
uint8_t *uvbuf= s->edge_emu_buffer + 19 * s->linesize;
srcY -= s->mspel * (1 + s->linesize);