Fixes: out of array access Fixes: BIGSLEEP-436510316/dwa_uncompress_write.exr
Showing the changes to libavcodec (1 of 1 file). Show all
Unified · Split
| @@ -1127,6 +1127,8 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse · 1126 unmodified lines | ||
| 1127 | 1127 | float *yb = td->block[0]; |
| 1128 | 1128 | float *ub = td->block[1]; |
| 1129 | 1129 | float *vb = td->block[2]; |
| 1130 | + int bw = FFMIN(8, td->xsize - x); | |
| 1131 | + int bh = FFMIN(8, td->ysize - y); | |
| 1130 | 1132 | |
| 1131 | 1133 | memset(td->block, 0, sizeof(td->block)); |
| 1132 | 1134 | |
| @@ -1151,8 +1153,8 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse · 18 unmodified lines | ||
| 1151 | 1153 | uint16_t *ro = ((uint16_t *)td->uncompressed_data) + |
| 1152 | 1154 | y * td->xsize * s->nb_channels + td->xsize * (o + 2) + x; |
| 1153 | 1155 | |
| 1154 | − for (int yy = 0; yy < 8; yy++) { | |
| 1155 | − for (int xx = 0; xx < 8; xx++) { | |
| 1156 | + for (int yy = 0; yy < bh; yy++) { | |
| 1157 | + for (int xx = 0; xx < bw; xx++) { | |
| 1156 | 1158 | const int idx = xx + yy * 8; |
| 1157 | 1159 | float b, g, r; |
| 1158 | 1160 | |
| @@ -1175,8 +1177,8 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse · 16 unmodified lines | ||
| 1175 | 1177 | float *ro = ((float *)td->uncompressed_data) + |
| 1176 | 1178 | y * td->xsize * s->nb_channels + td->xsize * (o + 2) + x; |
| 1177 | 1179 | |
| 1178 | − for (int yy = 0; yy < 8; yy++) { | |
| 1179 | − for (int xx = 0; xx < 8; xx++) { | |
| 1180 | + for (int yy = 0; yy < bh; yy++) { | |
| 1181 | + for (int xx = 0; xx < bw; xx++) { | |
| 1180 | 1182 | const int idx = xx + yy * 8; |
| 1181 | 1183 | |
| 1182 | 1184 | convert(yb[idx], ub[idx], vb[idx], &bo[xx], &go[xx], &ro[xx]); |