@@ -143,11 +143,22 @@ static void copy_CTB(uint8_t *dst, const uint8_t *src, int width, int height,
if (((intptr_t)dst | (intptr_t)src | stride_dst | stride_src) & 15) {
for (i = 0; i < height; i++) {
- for (j = 0; j < width; j+=8)
+ for (j = 0; j < width - 7; j+=8)
AV_COPY64U(dst+j, src+j);
dst += stride_dst;
src += stride_src;
}
+ if (width&7) {
+ dst += ((width>>3)<<3) - stride_dst * height;
+ src += ((width>>3)<<3) - stride_src * height;
+ width &= 7;
+ for (i = 0; i < height; i++) {
+ for (j = 0; j < width; j++)
+ dst[j] = src[j];
+ dst += stride_dst;
+ src += stride_src;
+ }
+ }
} else {
for (i = 0; i < height; i++) {
for (j = 0; j < width; j+=16)
Fixes: out of array access Fixes: 49271/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5424984922652672 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/hevc_filter.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)