motionpixels: Clip YUV values after applying a gradient.
Prevents illegal reads on truncated and malformed input. CC: libav-stable@libav.org (cherry picked from commit b5da848facd41169283d7bfe568b83bdfa7fc42e) Signed-off-by: Reinhard Tartler <siretart@tauware.de> (cherry picked from commit aaa6a666774eb02c351c84e80622a5c69e9b642e) Signed-off-by: Reinhard Tartler <siretart@tauware.de> (cherry picked from commit 50073e2395522b6e2b8698ff0dd06ffaf8cbf8ce) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This commit is contained in:
parent
5933af562e
commit
e9c9707316
@ -188,10 +188,13 @@ static void mp_decode_line(MotionPixelsContext *mp, GetBitContext *gb, int y)
|
||||
p = mp_get_yuv_from_rgb(mp, x - 1, y);
|
||||
} else {
|
||||
p.y += mp_gradient(mp, 0, mp_get_vlc(mp, gb));
|
||||
p.y = av_clip(p.y, 0, 31);
|
||||
if ((x & 3) == 0) {
|
||||
if ((y & 3) == 0) {
|
||||
p.v += mp_gradient(mp, 1, mp_get_vlc(mp, gb));
|
||||
p.v = av_clip(p.v, -32, 31);
|
||||
p.u += mp_gradient(mp, 2, mp_get_vlc(mp, gb));
|
||||
p.u = av_clip(p.u, -32, 31);
|
||||
mp->hpt[((y / 4) * mp->avctx->width + x) / 4] = p;
|
||||
} else {
|
||||
p.v = mp->hpt[((y / 4) * mp->avctx->width + x) / 4].v;
|
||||
@ -215,9 +218,12 @@ static void mp_decode_frame_helper(MotionPixelsContext *mp, GetBitContext *gb)
|
||||
p = mp_get_yuv_from_rgb(mp, 0, y);
|
||||
} else {
|
||||
p.y += mp_gradient(mp, 0, mp_get_vlc(mp, gb));
|
||||
p.y = av_clip(p.y, 0, 31);
|
||||
if ((y & 3) == 0) {
|
||||
p.v += mp_gradient(mp, 1, mp_get_vlc(mp, gb));
|
||||
p.v = av_clip(p.v, -32, 31);
|
||||
p.u += mp_gradient(mp, 2, mp_get_vlc(mp, gb));
|
||||
p.u = av_clip(p.u, -32, 31);
|
||||
}
|
||||
mp->vpt[y] = p;
|
||||
mp_set_rgb_from_yuv(mp, 0, y, &p);
|
||||
|
Loading…
x
Reference in New Issue
Block a user