Commit e0723b7e authored by Michael Niedermayer's avatar Michael Niedermayer
Browse files

avcodec/hevc_filter: copy_CTB() only within width&height

Fixes: out of array access
Fixes: 49271/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5424984922652672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: default avatarMichael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 009ef35d

)
Signed-off-by: default avatarMichael Niedermayer <michael@niedermayer.cc>
parent 6fbd4d22
......@@ -143,11 +143,22 @@ static void copy_CTB(uint8_t *dst, const uint8_t *src, int width, int height,
if (((intptr_t)dst | (intptr_t)src | stride_dst | stride_src) & 15) {
for (i = 0; i < height; i++) {
for (j = 0; j < width; j+=8)
for (j = 0; j < width - 7; j+=8)
AV_COPY64U(dst+j, src+j);
dst += stride_dst;
src += stride_src;
}
if (width&7) {
dst += ((width>>3)<<3) - stride_dst * height;
src += ((width>>3)<<3) - stride_src * height;
width &= 7;
for (i = 0; i < height; i++) {
for (j = 0; j < width; j++)
dst[j] = src[j];
dst += stride_dst;
src += stride_src;
}
}
} else {
for (i = 0; i < height; i++) {
for (j = 0; j < width; j+=16)
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment