[FFmpeg-devel] [PATCH] vp9: don't overread by 4 pixels in ff_vp9_avg4_mmxext().

[FFmpeg-devel] [PATCH] vp9: don't overread by 4 pixels in ff_vp9_avg4_mmxext().

[Ronald S. Bultje]

If the block is at the end of the allocated buffer and there is no
padding, this will over-read, which may cause crashes. Reported by
Firefox.
---
 libavcodec/x86/vp9mc.asm | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libavcodec/x86/vp9mc.asm b/libavcodec/x86/vp9mc.asm
index f64161b2c2..f8b244b2fe 100644
--- a/libavcodec/x86/vp9mc.asm
+++ b/libavcodec/x86/vp9mc.asm
@@ -604,12 +604,15 @@ cglobal vp9_%1%2 %+ %%szsuf, 5, 5, %8, dst, dstride, src, sstride, h
     %%pavg      m0, [dstq]
     %%pavg      m1, [dstq+d%3]
     %%pavg      m2, [dstq+d%4]
-    %%pavg      m3, [dstq+d%5]
 %if %2/mmsize == 8
+    %%pavg      m3, [dstq+d%5]
     %%pavg      m4, [dstq+mmsize*4]
     %%pavg      m5, [dstq+mmsize*5]
     %%pavg      m6, [dstq+mmsize*6]
     %%pavg      m7, [dstq+mmsize*7]
+%else
+    %%srcfn     m4, [dstq+d%5]
+    %%pavg      m3, m4
 %endif
 %endif
     %%dstfn [dstq], m0
-- 
2.34.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH] vp9: don't overread by 4 pixels in ff_vp9_avg4_mmxext().

[Ronald S. Bultje]

If the block is at the end of the allocated buffer and there is no
padding, this will over-read, which may cause crashes. Reported by
Firefox.
---
 libavcodec/x86/vp9mc.asm | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libavcodec/x86/vp9mc.asm b/libavcodec/x86/vp9mc.asm
index f64161b2c2..efc4cfbef1 100644
--- a/libavcodec/x86/vp9mc.asm
+++ b/libavcodec/x86/vp9mc.asm
@@ -604,7 +604,12 @@ cglobal vp9_%1%2 %+ %%szsuf, 5, 5, %8, dst, dstride, src, sstride, h
     %%pavg      m0, [dstq]
     %%pavg      m1, [dstq+d%3]
     %%pavg      m2, [dstq+d%4]
+%if %2 == 4
+    %%srcfn     m4, [dstq+d%5]
+    %%pavg      m3, m4
+%else
     %%pavg      m3, [dstq+d%5]
+%endif
 %if %2/mmsize == 8
     %%pavg      m4, [dstq+mmsize*4]
     %%pavg      m5, [dstq+mmsize*5]
-- 
2.34.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] vp9: don't overread by 4 pixels in ff_vp9_avg4_mmxext().

[Ronald S. Bultje]

Hi,

On Tue, May 31, 2022 at 9:21 AM Ronald S. Bultje <rsbultje@gmail.com> wrote:

> If the block is at the end of the allocated buffer and there is no
> padding, this will over-read, which may cause crashes. Reported by
> Firefox.
> ---
>  libavcodec/x86/vp9mc.asm | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/libavcodec/x86/vp9mc.asm b/libavcodec/x86/vp9mc.asm
> index f64161b2c2..efc4cfbef1 100644
> --- a/libavcodec/x86/vp9mc.asm
> +++ b/libavcodec/x86/vp9mc.asm
> @@ -604,7 +604,12 @@ cglobal vp9_%1%2 %+ %%szsuf, 5, 5, %8, dst, dstride,
> src, sstride, h
>      %%pavg      m0, [dstq]
>      %%pavg      m1, [dstq+d%3]
>      %%pavg      m2, [dstq+d%4]
> +%if %2 == 4
> +    %%srcfn     m4, [dstq+d%5]
> +    %%pavg      m3, m4
> +%else
>      %%pavg      m3, [dstq+d%5]
> +%endif
>  %if %2/mmsize == 8
>      %%pavg      m4, [dstq+mmsize*4]
>      %%pavg      m5, [dstq+mmsize*5]
> --
> 2.34.1
>

Merged.

Ronald
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".