If the block is at the end of the allocated buffer and there is no
padding, this will over-read, which may cause crashes. Reported by
Firefox.
---
libavcodec/x86/vp9mc.asm | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/libavcodec/x86/vp9mc.asm b/libavcodec/x86/vp9mc.asm
index f64161b2c2..f8b244b2fe 100644
--- a/libavcodec/x86/vp9mc.asm
+++ b/libavcodec/x86/vp9mc.asm
@@ -604,12 +604,15 @@ cglobal vp9_%1%2 %+ %%szsuf, 5, 5, %8, dst, dstride, src,
sstride, h
%%pavg m0, [dstq]
%%pavg m1, [dstq+d%3]
%%pavg m2, [dstq+d%4]
- %%pavg m3, [dstq+d%5]
%if %2/mmsize == 8
+ %%pavg m3, [dstq+d%5]
%%pavg m4, [dstq+mmsize*4]
%%pavg m5, [dstq+mmsize*5]
%%pavg m6, [dstq+mmsize*6]
%%pavg m7, [dstq+mmsize*7]
+%else
+ %%srcfn m4, [dstq+d%5]
+ %%pavg m3, m4
%endif
%endif
%%dstfn [dstq], m0
--
2.34.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
