diff options
| author | Suyog Pawar <suyog.pawar@ittiam.com> | 2022-10-07 17:42:45 +0530 |
|---|---|---|
| committer | Cherrypicker Worker <android-build-cherrypicker-worker@google.com> | 2022-11-24 15:17:39 +0000 |
| commit | b483f22a2116159176fd03ed7a568f9e302f203f (patch) | |
| tree | c8e8633ee4426bee2a1f46c334bdbf9b0201304d | |
| parent | 3c345ad386f6cffc7544049047255684dd481d1e (diff) | |
| download | libavc-b483f22a2116159176fd03ed7a568f9e302f203f.tar.gz | |
avcenc: Fix out of bound read in initialize process contextandroid-13.0.0_r82android-13.0.0_r81android-13.0.0_r80android-13.0.0_r74android-13.0.0_r73android-13.0.0_r72android-13.0.0_r66android-13.0.0_r65android-13.0.0_r64android-13.0.0_r60android-13.0.0_r59android-13.0.0_r58android13-qpr3-c-s8-releaseandroid13-qpr3-c-s7-releaseandroid13-qpr3-c-s6-releaseandroid13-qpr3-c-s5-releaseandroid13-qpr3-c-s4-releaseandroid13-qpr3-c-s3-releaseandroid13-qpr3-c-s2-releaseandroid13-qpr3-c-s12-releaseandroid13-qpr3-c-s11-releaseandroid13-qpr3-c-s10-releaseandroid13-qpr3-c-s1-release
Using incorrect stride during copy from source buffer to intermediate buffer. This is corrected
Bug: 242379731
Bug: 242386193
Test: avcenc -c enc.cfg
Change-Id: I307525906ee6f6df5d8e114ebbafa40d6442662d
(cherry picked from commit 0a87a34fccffe15c2cc80670cf1058e7a3313c6a)
Merged-In: I307525906ee6f6df5d8e114ebbafa40d6442662d
| -rw-r--r-- | encoder/ih264e_process.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/encoder/ih264e_process.c b/encoder/ih264e_process.c index bf4c1e7..818e192 100644 --- a/encoder/ih264e_process.c +++ b/encoder/ih264e_process.c @@ -1329,7 +1329,7 @@ IH264E_ERROR_T ih264e_init_proc_ctxt(process_ctxt_t *ps_proc) num_rows = MB_SIZE - u4_pad_bottom_sz; for (i = 0; i < num_rows; i++) { - memcpy(pu1_dst, pu1_src, ps_codec->s_cfg.u4_wd); + memcpy(pu1_dst, pu1_src, ps_codec->s_cfg.u4_disp_wd); pu1_src += ps_proc->s_inp_buf.s_raw_buf.au4_strd[0]; pu1_dst += ps_proc->i4_src_strd; } @@ -1346,7 +1346,7 @@ IH264E_ERROR_T ih264e_init_proc_ctxt(process_ctxt_t *ps_proc) num_rows = BLK8x8SIZE; for (i = 0; i < num_rows; i++) { - memcpy(pu1_dst, pu1_src, ps_codec->s_cfg.u4_wd); + memcpy(pu1_dst, pu1_src, ps_codec->s_cfg.u4_disp_wd); pu1_src += ps_proc->s_inp_buf.s_raw_buf.au4_strd[1]; pu1_dst += ps_proc->i4_src_chroma_strd; } @@ -1417,7 +1417,7 @@ IH264E_ERROR_T ih264e_init_proc_ctxt(process_ctxt_t *ps_proc) ps_proc->s_inp_buf.s_raw_buf.au4_strd[0] * (i4_mb_y * MB_SIZE) - ps_proc->s_inp_buf.s_raw_buf.au4_strd[0]; UWORD8 *pu1_dst = ps_proc->pu1_src_buf_luma - ps_proc->i4_src_strd; - memcpy(pu1_dst, pu1_src, ps_codec->s_cfg.u4_wd); + memcpy(pu1_dst, pu1_src, ps_codec->s_cfg.u4_disp_wd); if (u4_pad_right_sz && (ps_proc->i4_mb_x == 0)) { pu1_dst += ps_codec->s_cfg.u4_disp_wd; memset(pu1_dst, pu1_dst[-1], u4_pad_right_sz); |