Do not attempt to use the unscaled yuv2rgb converter when height is odd because
authorMichael Niedermayer <michaelni@gmx.at>
Sat, 25 Oct 2008 15:00:28 +0000 (15:00 +0000)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 25 Oct 2008 15:00:28 +0000 (15:00 +0000)
it will overflow the buffer by 1 line. This might have been exploitable.

Originally committed as revision 27826 to svn://svn.mplayerhq.hu/mplayer/trunk/libswscale

libswscale/swscale.c

index a926bad..62c0548 100644 (file)
@@ -2312,7 +2312,7 @@ SwsContext *sws_getContext(int srcW, int srcH, enum PixelFormat srcFormat, int d
 #ifdef CONFIG_GPL
         /* yuv2bgr */
         if ((srcFormat==PIX_FMT_YUV420P || srcFormat==PIX_FMT_YUV422P) && (isBGR(dstFormat) || isRGB(dstFormat))
-            && !(flags & SWS_ACCURATE_RND))
+            && !(flags & SWS_ACCURATE_RND) && !(dstH&1))
         {
             c->swScale= yuv2rgb_get_func_ptr(c);
         }