From d04956344d38ddd77ec61042ce57cd9021491c83 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 12 May 2012 10:57:15 +0200 Subject: tiffenc: fix out of array read Fixes ticket1112 Found-by: ami_stuff Signed-off-by: Michael Niedermayer --- libavcodec/tiffenc.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) (limited to 'libavcodec/tiffenc.c') diff --git a/libavcodec/tiffenc.c b/libavcodec/tiffenc.c index 587e98e277..9f90c618d8 100644 --- a/libavcodec/tiffenc.c +++ b/libavcodec/tiffenc.c @@ -193,13 +193,24 @@ static void pack_yuv(TiffEncoderContext * s, uint8_t * dst, int lnum) int w = (s->width - 1) / s->subsampling[0] + 1; uint8_t *pu = &p->data[1][lnum / s->subsampling[1] * p->linesize[1]]; uint8_t *pv = &p->data[2][lnum / s->subsampling[1] * p->linesize[2]]; - for (i = 0; i < w; i++){ - for (j = 0; j < s->subsampling[1]; j++) - for (k = 0; k < s->subsampling[0]; k++) - *dst++ = p->data[0][(lnum + j) * p->linesize[0] + - i * s->subsampling[0] + k]; - *dst++ = *pu++; - *dst++ = *pv++; + if(s->width % s->subsampling[0] || s->height % s->subsampling[1]){ + for (i = 0; i < w; i++){ + for (j = 0; j < s->subsampling[1]; j++) + for (k = 0; k < s->subsampling[0]; k++) + *dst++ = p->data[0][FFMIN(lnum + j, s->height-1) * p->linesize[0] + + FFMIN(i * s->subsampling[0] + k, s->width-1)]; + *dst++ = *pu++; + *dst++ = *pv++; + } + }else{ + for (i = 0; i < w; i++){ + for (j = 0; j < s->subsampling[1]; j++) + for (k = 0; k < s->subsampling[0]; k++) + *dst++ = p->data[0][(lnum + j) * p->linesize[0] + + i * s->subsampling[0] + k]; + *dst++ = *pu++; + *dst++ = *pv++; + } } } -- cgit v1.2.3