avfilter/vf_pad: fix req_end
authorMichael Niedermayer <michaelni@gmx.at>
Tue, 3 Dec 2013 03:08:37 +0000 (04:08 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Tue, 3 Dec 2013 03:09:10 +0000 (04:09 +0100)
Fixes out of array accesses
Fixes Ticket3190

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavfilter/vf_pad.c

index 2740c63..2962e20 100644 (file)
@@ -251,7 +251,7 @@ static int buffer_needs_copy(PadContext *s, AVFrame *frame, AVBufferRef *buf)
                               (s->y >> vsub) * frame->linesize[planes[i]];
         ptrdiff_t req_end   = ((s->w - s->x - frame->width) >> hsub) *
                               s->draw.pixelstep[planes[i]] +
-                              (s->y >> vsub) * frame->linesize[planes[i]];
+                              ((s->h - s->y - frame->height) >> vsub) * frame->linesize[planes[i]];
 
         if (frame->linesize[planes[i]] < (s->w >> hsub) * s->draw.pixelstep[planes[i]])
             return 1;