From c4e2b8268f9c59a34d60e48afe8541b042d8b4e6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Storsj=C3=B6?= Date: Fri, 16 Jul 2010 17:45:50 +0000 Subject: [PATCH] In planarCopyWrapper, Only copy length, not stride of the last line in the plane If the destination planes are offset within the destination buffer, writing the extra bytes at the end may write outside of the destination buffer. Originally committed as revision 31746 to svn://svn.mplayerhq.hu/mplayer/trunk/libswscale --- libswscale/swscale.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/libswscale/swscale.c b/libswscale/swscale.c index 159bf9cc81..b589131375 100644 --- a/libswscale/swscale.c +++ b/libswscale/swscale.c @@ -1663,9 +1663,11 @@ static int planarCopyWrapper(SwsContext *c, const uint8_t* src[], int srcStride[ srcPtr+= srcStride[plane]; dstPtr+= dstStride[plane]; } - } else if (dstStride[plane]==srcStride[plane] && srcStride[plane] > 0) - memcpy(dst[plane] + dstStride[plane]*y, src[plane], height*dstStride[plane]); - else { + } else if (dstStride[plane]==srcStride[plane] && srcStride[plane] > 0) { + if (height > 0) + memcpy(dst[plane] + dstStride[plane]*y, src[plane], + (height - 1)*dstStride[plane] + length); + } else { if(is16BPS(c->srcFormat) && is16BPS(c->dstFormat)) length*=2; for (i=0; i