diff mbox series

[FFmpeg-devel] avcodec/yuv4enc: do not read past end of input in case of odd height

Message ID CAPYw7P7-mNMfw0tXBPPtH2CWZk0K4Vg1jcYUMTbG_=DjyYgk2A@mail.gmail.com
State New
Headers show
Series [FFmpeg-devel] avcodec/yuv4enc: do not read past end of input in case of odd height | expand

Commit Message

Paul B Mahol Sept. 6, 2023, 12:35 a.m. UTC
Attached.

Comments

Tomas Härdin Sept. 6, 2023, 6:16 a.m. UTC | #1
ons 2023-09-06 klockan 02:35 +0200 skrev Paul B Mahol:
> +    if (avctx->height & 1) {
> +        for (j = 0; j < avctx->width + 1 >> 1; j++) {

Don't we usually wrap shifted expressions in parentheses? I know >> is
lower presedence than + (a wtf in itself tbh) but I seem to recall
parens being the norm in much of the codebase.

/Tomas
Anton Khirnov Sept. 6, 2023, 11:18 a.m. UTC | #2
Quoting Tomas Härdin (2023-09-06 08:16:12)
> ons 2023-09-06 klockan 02:35 +0200 skrev Paul B Mahol:
> > +    if (avctx->height & 1) {
> > +        for (j = 0; j < avctx->width + 1 >> 1; j++) {
> 
> Don't we usually wrap shifted expressions in parentheses? I know >> is
> lower presedence than + (a wtf in itself tbh) but I seem to recall
> parens being the norm in much of the codebase.

Using ">> 1" to mean "/ 2" is a relic from the days of non-optimizing
compilers anyway.
Andreas Rheinhardt Sept. 6, 2023, 11:33 a.m. UTC | #3
Anton Khirnov:
> Quoting Tomas Härdin (2023-09-06 08:16:12)
>> ons 2023-09-06 klockan 02:35 +0200 skrev Paul B Mahol:
>>> +    if (avctx->height & 1) {
>>> +        for (j = 0; j < avctx->width + 1 >> 1; j++) {
>>
>> Don't we usually wrap shifted expressions in parentheses? I know >> is
>> lower presedence than + (a wtf in itself tbh) but I seem to recall
>> parens being the norm in much of the codebase.
> 
> Using ">> 1" to mean "/ 2" is a relic from the days of non-optimizing
> compilers anyway.
> 

Incorrect for signed expressions (right shift rounds to -inf, division
to zero).

- Andreas
diff mbox series

Patch

From 8295be1415649255b26cfdb0308d7be208711b4d Mon Sep 17 00:00:00 2001
From: Paul B Mahol <onemda@gmail.com>
Date: Wed, 6 Sep 2023 02:27:56 +0200
Subject: [PATCH] avcodec/yuv4enc: do not read past end of input in case of odd
 height

Signed-off-by: Paul B Mahol <onemda@gmail.com>
---
 libavcodec/yuv4enc.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/libavcodec/yuv4enc.c b/libavcodec/yuv4enc.c
index 8123260d5d..dd1874ff25 100644
--- a/libavcodec/yuv4enc.c
+++ b/libavcodec/yuv4enc.c
@@ -41,7 +41,7 @@  static int yuv4_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
     u = pic->data[1];
     v = pic->data[2];
 
-    for (i = 0; i < avctx->height + 1 >> 1; i++) {
+    for (i = 0; i < avctx->height >> 1; i++) {
         for (j = 0; j < avctx->width + 1 >> 1; j++) {
             *dst++ = u[j] ^ 0x80;
             *dst++ = v[j] ^ 0x80;
@@ -55,6 +55,17 @@  static int yuv4_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
         v +=     pic->linesize[2];
     }
 
+    if (avctx->height & 1) {
+        for (j = 0; j < avctx->width + 1 >> 1; j++) {
+            *dst++ = u[j] ^ 0x80;
+            *dst++ = v[j] ^ 0x80;
+            *dst++ = y[2 * j    ];
+            *dst++ = y[2 * j + 1];
+            *dst++ = y[2 * j    ];
+            *dst++ = y[2 * j + 1];
+        }
+    }
+
     *got_packet = 1;
     return 0;
 }
-- 
2.39.1