Fixes: out of array access Fixes: BIGSLEEP-436510316/dwa_uncompress_write.exr
Showing the changes to libavcodec (1 of 1 file). Show all
Unified · Split
| @@ -1127,6 +1127,8 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse · 1126 unmodified lines | |||
| 1127 | float *yb = td->block[0]; | 1127 | float *yb = td->block[0]; |
| 1128 | float *ub = td->block[1]; | 1128 | float *ub = td->block[1]; |
| 1129 | float *vb = td->block[2]; | 1129 | float *vb = td->block[2]; |
| 1130 | int bw = FFMIN(8, td->xsize - x); | ||
| 1131 | int bh = FFMIN(8, td->ysize - y); | ||
| 1130 | 1132 | ||
| 1131 | memset(td->block, 0, sizeof(td->block)); | 1133 | memset(td->block, 0, sizeof(td->block)); |
| 1132 | 1134 | ||
| @@ -1151,8 +1153,8 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse · 18 unmodified lines | |||
| 1151 | uint16_t *ro = ((uint16_t *)td->uncompressed_data) + | 1153 | uint16_t *ro = ((uint16_t *)td->uncompressed_data) + |
| 1152 | y * td->xsize * s->nb_channels + td->xsize * (o + 2) + x; | 1154 | y * td->xsize * s->nb_channels + td->xsize * (o + 2) + x; |
| 1153 | 1155 | ||
| 1154 | for (int yy = 0; yy < 8; yy++) { | 1156 | for (int yy = 0; yy < bh; yy++) { |
| 1155 | for (int xx = 0; xx < 8; xx++) { | 1157 | for (int xx = 0; xx < bw; xx++) { |
| 1156 | const int idx = xx + yy * 8; | 1158 | const int idx = xx + yy * 8; |
| 1157 | float b, g, r; | 1159 | float b, g, r; |
| 1158 | 1160 | ||
| @@ -1175,8 +1177,8 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse · 16 unmodified lines | |||
| 1175 | float *ro = ((float *)td->uncompressed_data) + | 1177 | float *ro = ((float *)td->uncompressed_data) + |
| 1176 | y * td->xsize * s->nb_channels + td->xsize * (o + 2) + x; | 1178 | y * td->xsize * s->nb_channels + td->xsize * (o + 2) + x; |
| 1177 | 1179 | ||
| 1178 | for (int yy = 0; yy < 8; yy++) { | 1180 | for (int yy = 0; yy < bh; yy++) { |
| 1179 | for (int xx = 0; xx < 8; xx++) { | 1181 | for (int xx = 0; xx < bw; xx++) { |
| 1180 | const int idx = xx + yy * 8; | 1182 | const int idx = xx + yy * 8; |
| 1181 | 1183 | ||
| 1182 | convert(yb[idx], ub[idx], vb[idx], &bo[xx], &go[xx], &ro[xx]); | 1184 | convert(yb[idx], ub[idx], vb[idx], &bo[xx], &go[xx], &ro[xx]); |