har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

libswscale: avoid UB nullptr-with-offset.

Browse Source 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Jeremy Leconte 2020-12-24 04:27:19 +00:00 committed by Michael Niedermayer
parent aea8d4061d
commit 29cef1bcd6
2 changed files with 5 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libswscale/slice.c
View File

@ -158,14 +158,10 @@ int ff_init_slice_from_src(SwsSlice * s, uint8_t *src[4], int stride[4], int src
chrY + chrH,
lumY + lumH};
uint8_t *const src_[4] = {src[0] + (relative ? 0 : start[0]) * stride[0],
src[1] + (relative ? 0 : start[1]) * stride[1],
src[2] + (relative ? 0 : start[2]) * stride[2],
src[3] + (relative ? 0 : start[3]) * stride[3]};
s->width = srcW;
for (i = 0; i < 4; ++i) {
for (i = 0; i < 4 && src[i] != NULL; ++i) {
uint8_t *const src_i = src[i] + (relative ? 0 : start[i]) * stride[i];
int j;
int first = s->plane[i].sliceY;
int n = s->plane[i].available_lines;
@ -175,13 +171,13 @@ int ff_init_slice_from_src(SwsSlice * s, uint8_t *src[4], int stride[4], int src
if (start[i] >= first && n >= tot_lines) {
s->plane[i].sliceH = FFMAX(tot_lines, s->plane[i].sliceH);
for (j = 0; j < lines; j+= 1)
s->plane[i].line[start[i] - first + j] = src_[i] + j * stride[i];
s->plane[i].line[start[i] - first + j] = src_i + j * stride[i];
} else {
s->plane[i].sliceY = start[i];
lines = lines > n ? n : lines;
s->plane[i].sliceH = lines;
for (j = 0; j < lines; j+= 1)
s->plane[i].line[j] = src_[i] + j * stride[i];
s->plane[i].line[j] = src_i + j * stride[i];
}
}

4
libswscale/swscale_unscaled.c
View File

@ -1805,7 +1805,7 @@ static int planarCopyWrapper(SwsContext *c, const uint8_t *src[],
const AVPixFmtDescriptor *desc_src = av_pix_fmt_desc_get(c->srcFormat);
const AVPixFmtDescriptor *desc_dst = av_pix_fmt_desc_get(c->dstFormat);
int plane, i, j;
for (plane = 0; plane < 4; plane++) {
for (plane = 0; plane < 4 && dst[plane] != NULL; plane++) {
int length = (plane == 0 || plane == 3) ? c->srcW : AV_CEIL_RSHIFT(c->srcW, c->chrDstHSubSample);
int y = (plane == 0 || plane == 3) ? srcSliceY: AV_CEIL_RSHIFT(srcSliceY, c->chrDstVSubSample);
int height = (plane == 0 || plane == 3) ? srcSliceH: AV_CEIL_RSHIFT(srcSliceH, c->chrDstVSubSample);
@ -1813,8 +1813,6 @@ static int planarCopyWrapper(SwsContext *c, const uint8_t *src[],
uint8_t *dstPtr = dst[plane] + dstStride[plane] * y;
int shiftonly = plane == 1 || plane == 2 || (!c->srcRange && plane == 0);
if (!dst[plane])
continue;
// ignore palette for GRAY8
if (plane == 1 && !dst[2]) continue;
if (!src[plane] || (plane == 1 && !src[2])) {