out of buffer access fix

git-svn-id: file:///var/local/repositories/ffmpeg/trunk@3744 9553f0bf-9b14-0410-a0b8-cfaf0461ba5b

out of buffer access fix
git-svn-id: file:///var/local/repositories/ffmpeg/trunk@3744 9553f0bf-9b14-0410-a0b8-cfaf0461ba5b
e6fa8bca · michael · b1c519b1 · e6fa8bca
Commit e6fa8bca authored Dec 09, 2004 by michael
Hide whitespace changes
Inline Side-by-side

Showing with 14 additions and 9 deletions

libavcodec/h264.c libavcodec/h264.c +14 -9

No files found.
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -2401,18 +2401,23 @@ static void hl_decode_mb(H264Context *h){
            if(!s->encoding){
                for(i=0; i<16; i++){
                    uint8_t * const ptr= dest_y + h->block_offset[i];
-                    uint8_t *topright= ptr + 4 - linesize;
+                    uint8_t *topright;
-                    const int topright_avail= (h->topright_samples_available<<i)&0x8000;
                    const int dir= h->intra4x4_pred_mode_cache[ scan8[i] ];
                    int tr;
-                    if(!topright_avail){
+                    if(dir == DIAG_DOWN_LEFT_PRED || dir == VERT_LEFT_PRED){
-                        tr= ptr[3 - linesize]*0x01010101;
+                        const int topright_avail= (h->topright_samples_available<<i)&0x8000;
-                        topright= (uint8_t*) &tr;
+                        assert(mb_y || linesize <= h->block_offset[i]);
-                    }else if(i==5 && h->deblocking_filter){
+                        if(!topright_avail){
-                        tr= *(uint32_t*)h->top_border[mb_x+1];
+                            tr= ptr[3 - linesize]*0x01010101;
-                        topright= (uint8_t*) &tr;
+                            topright= (uint8_t*) &tr;
-                    }
+                        }else if(i==5 && h->deblocking_filter){
+                            tr= *(uint32_t*)h->top_border[mb_x+1];
+                            topright= (uint8_t*) &tr;
+                        }else
+                            topright= ptr + 4 - linesize;
+                    }else
+                        topright= NULL;
                    h->pred4x4[ dir ](ptr, topright, linesize);
                    if(h->non_zero_count_cache[ scan8[i] ]){