From fed483f188b3cd50d25068d74bda00b4f12f5fc8 Mon Sep 17 00:00:00 2001 From: "Ronald S. Bultje" Date: Sun, 20 Oct 2013 21:05:28 +0200 Subject: avcodec/vp9dsp: fix overwrite by 1 in vert_left pred. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The memset following the memcpy was silencing the problem since re-writing that same byte. Fixes CID1108597, CID1108598, (16x16) CID1108599, CID1108600, (8x8) CID1108601, CID1108602 (32x32) Signed-off-by: Clément Bœsch --- libavcodec/vp9dsp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'libavcodec/vp9dsp.c') diff --git a/libavcodec/vp9dsp.c b/libavcodec/vp9dsp.c index d35d753..6159616 100644 --- a/libavcodec/vp9dsp.c +++ b/libavcodec/vp9dsp.c @@ -772,9 +772,9 @@ static void vert_left_##size##x##size##_c(uint8_t *dst, ptrdiff_t stride, \ vo[size - 2] = (top[size - 2] + top[size - 1] * 3 + 2) >> 2; \ \ for (j = 0; j < size / 2; j++) { \ - memcpy(dst + j*2 * stride, ve + j, size - j); \ + memcpy(dst + j*2 * stride, ve + j, size - j - 1); \ memset(dst + j*2 * stride + size - j - 1, top[size - 1], j + 1); \ - memcpy(dst + (j*2 + 1) * stride, vo + j, size - j); \ + memcpy(dst + (j*2 + 1) * stride, vo + j, size - j - 1); \ memset(dst + (j*2 + 1) * stride + size - j - 1, top[size - 1], j + 1); \ } \ } -- cgit v1.1