mpegvideo_motion: Handle edge emulation even without unrestricted_mv
authorMichael Niedermayer <michaelni@gmx.at>
Tue, 12 Nov 2013 15:11:42 +0000 (16:11 +0100)
committerDiego Biurrun <diego@biurrun.de>
Thu, 17 Nov 2016 16:23:04 +0000 (17:23 +0100)
Fix out of bounds read.

Bug-Id: 959
Found by: F4B3CD@STARLAB and Agostino Sarubbo
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
(cherry picked from commit 136f55207521f0b03194ef5b55ba70f1635d6aee)
(cherry picked from commit 7a1e60a834f75cc6c7cba02bb2a85edc355f50c0)
Signed-off-by: Diego Biurrun <diego@biurrun.de>
libavcodec/mpegvideo_common.h

index 763c319..be7f7a5 100644 (file)
@@ -220,14 +220,12 @@ static inline int hpel_motion(MpegEncContext *s,
         dxy &= ~2;
     src += src_y * stride + src_x;
 
-    if(s->unrestricted_mv && (s->flags&CODEC_FLAG_EMU_EDGE)){
-        if(   (unsigned)src_x > FFMAX(h_edge_pos - (motion_x&1) - w, 0)
-           || (unsigned)src_y > FFMAX(v_edge_pos - (motion_y&1) - h, 0)){
-            s->dsp.emulated_edge_mc(s->edge_emu_buffer, src, s->linesize, w+1, (h+1)<<field_based,
-                             src_x, src_y<<field_based, h_edge_pos, s->v_edge_pos);
-            src= s->edge_emu_buffer;
-            emu=1;
-        }
+    if(   (unsigned)src_x > FFMAX(h_edge_pos - (motion_x&1) - w, 0)
+          || (unsigned)src_y > FFMAX(v_edge_pos - (motion_y&1) - h, 0)){
+        s->dsp.emulated_edge_mc(s->edge_emu_buffer, src, s->linesize, w+1, (h+1)<<field_based,
+                                src_x, src_y<<field_based, h_edge_pos, s->v_edge_pos);
+        src= s->edge_emu_buffer;
+        emu=1;
     }
     if(field_select)
         src += s->linesize;