Ticket #3152: 0001-mpegvideo-Add-check-for-pointer-overflow-to-demonstr.patch

File 0001-mpegvideo-Add-check-for-pointer-overflow-to-demonstr.patch, 1.2 KB (added by Will Dietz, 13 years ago)

  • libavcodec/mpegvideo.c 

    From 3bc47b421f66ffa434da59384394ce2002dafeae Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Tue, 19 Nov 2013 15:41:35 -0600
Subject: [PATCH] mpegvideo: Add check for pointer overflow to demonstrate issue.

---
 libavcodec/mpegvideo.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/libavcodec/mpegvideo.c b/libavcodec/mpegvideo.c
index 00d58dc..1676082 100644
    a b void ff_init_block_index(MpegEncContext *s){ //FIXME maybe rename  
    30463046    s->block_index[5]= s->mb_stride*(s->mb_y + s->mb_height + 2) + s->b8_stride*s->mb_height*2 + s->mb_x - 1;
    30473047    //block_index is not used by mpeg2, so it is not affected by chroma_format
    30483048
     3049    if (!s->current_picture.f.data[0] && (((s->mb_x - 1) << mb_size) < -1)) {
     3050      fprintf(stderr, "Error: pointer overflow!\n");
     3051      abort();
     3052    }
    30493053    s->dest[0] = s->current_picture.f.data[0] + ((s->mb_x - 1) <<  mb_size);
    30503054    s->dest[1] = s->current_picture.f.data[1] + ((s->mb_x - 1) << (mb_size - s->chroma_x_shift));
    30513055    s->dest[2] = s->current_picture.f.data[2] + ((s->mb_x - 1) << (mb_size - s->chroma_x_shift));