ffmpeg | branch: master | Ronald S. Bultje <rsbul...@gmail.com> | Tue May 31 08:30:37 2022 -0400| [6e13c30a8fd45e14303ef4a8e4da3554d5b4ba8e] | committer: Ronald S. Bultje
vp9: don't overread by 4 pixels in ff_vp9_avg4_mmxext(). If the block is at the end of the allocated buffer and there is no padding, this will over-read, which may cause crashes. Reported by Firefox. > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6e13c30a8fd45e14303ef4a8e4da3554d5b4ba8e --- libavcodec/x86/vp9mc.asm | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/x86/vp9mc.asm b/libavcodec/x86/vp9mc.asm index f64161b2c2..efc4cfbef1 100644 --- a/libavcodec/x86/vp9mc.asm +++ b/libavcodec/x86/vp9mc.asm @@ -604,7 +604,12 @@ cglobal vp9_%1%2 %+ %%szsuf, 5, 5, %8, dst, dstride, src, sstride, h %%pavg m0, [dstq] %%pavg m1, [dstq+d%3] %%pavg m2, [dstq+d%4] +%if %2 == 4 + %%srcfn m4, [dstq+d%5] + %%pavg m3, m4 +%else %%pavg m3, [dstq+d%5] +%endif %if %2/mmsize == 8 %%pavg m4, [dstq+mmsize*4] %%pavg m5, [dstq+mmsize*5] _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
