* [FFmpeg-devel] [PATCH] vp9: don't overread by 4 pixels in ff_vp9_avg4_mmxext(). [not found] <20220531123147.56064-1-rsbultje@gmail.com> @ 2022-05-31 12:41 ` Ronald S. Bultje 2022-05-31 13:21 ` Ronald S. Bultje 0 siblings, 1 reply; 3+ messages in thread From: Ronald S. Bultje @ 2022-05-31 12:41 UTC (permalink / raw) To: ffmpeg-devel; +Cc: Ronald S. Bultje If the block is at the end of the allocated buffer and there is no padding, this will over-read, which may cause crashes. Reported by Firefox. --- libavcodec/x86/vp9mc.asm | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavcodec/x86/vp9mc.asm b/libavcodec/x86/vp9mc.asm index f64161b2c2..f8b244b2fe 100644 --- a/libavcodec/x86/vp9mc.asm +++ b/libavcodec/x86/vp9mc.asm @@ -604,12 +604,15 @@ cglobal vp9_%1%2 %+ %%szsuf, 5, 5, %8, dst, dstride, src, sstride, h %%pavg m0, [dstq] %%pavg m1, [dstq+d%3] %%pavg m2, [dstq+d%4] - %%pavg m3, [dstq+d%5] %if %2/mmsize == 8 + %%pavg m3, [dstq+d%5] %%pavg m4, [dstq+mmsize*4] %%pavg m5, [dstq+mmsize*5] %%pavg m6, [dstq+mmsize*6] %%pavg m7, [dstq+mmsize*7] +%else + %%srcfn m4, [dstq+d%5] + %%pavg m3, m4 %endif %endif %%dstfn [dstq], m0 -- 2.34.1 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". ^ permalink raw reply [flat|nested] 3+ messages in thread
* [FFmpeg-devel] [PATCH] vp9: don't overread by 4 pixels in ff_vp9_avg4_mmxext(). 2022-05-31 12:41 ` [FFmpeg-devel] [PATCH] vp9: don't overread by 4 pixels in ff_vp9_avg4_mmxext() Ronald S. Bultje @ 2022-05-31 13:21 ` Ronald S. Bultje 2022-06-01 18:32 ` Ronald S. Bultje 0 siblings, 1 reply; 3+ messages in thread From: Ronald S. Bultje @ 2022-05-31 13:21 UTC (permalink / raw) To: ffmpeg-devel; +Cc: Ronald S. Bultje If the block is at the end of the allocated buffer and there is no padding, this will over-read, which may cause crashes. Reported by Firefox. --- libavcodec/x86/vp9mc.asm | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/x86/vp9mc.asm b/libavcodec/x86/vp9mc.asm index f64161b2c2..efc4cfbef1 100644 --- a/libavcodec/x86/vp9mc.asm +++ b/libavcodec/x86/vp9mc.asm @@ -604,7 +604,12 @@ cglobal vp9_%1%2 %+ %%szsuf, 5, 5, %8, dst, dstride, src, sstride, h %%pavg m0, [dstq] %%pavg m1, [dstq+d%3] %%pavg m2, [dstq+d%4] +%if %2 == 4 + %%srcfn m4, [dstq+d%5] + %%pavg m3, m4 +%else %%pavg m3, [dstq+d%5] +%endif %if %2/mmsize == 8 %%pavg m4, [dstq+mmsize*4] %%pavg m5, [dstq+mmsize*5] -- 2.34.1 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [FFmpeg-devel] [PATCH] vp9: don't overread by 4 pixels in ff_vp9_avg4_mmxext(). 2022-05-31 13:21 ` Ronald S. Bultje @ 2022-06-01 18:32 ` Ronald S. Bultje 0 siblings, 0 replies; 3+ messages in thread From: Ronald S. Bultje @ 2022-06-01 18:32 UTC (permalink / raw) To: FFmpeg development discussions and patches Hi, On Tue, May 31, 2022 at 9:21 AM Ronald S. Bultje <rsbultje@gmail.com> wrote: > If the block is at the end of the allocated buffer and there is no > padding, this will over-read, which may cause crashes. Reported by > Firefox. > --- > libavcodec/x86/vp9mc.asm | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/libavcodec/x86/vp9mc.asm b/libavcodec/x86/vp9mc.asm > index f64161b2c2..efc4cfbef1 100644 > --- a/libavcodec/x86/vp9mc.asm > +++ b/libavcodec/x86/vp9mc.asm > @@ -604,7 +604,12 @@ cglobal vp9_%1%2 %+ %%szsuf, 5, 5, %8, dst, dstride, > src, sstride, h > %%pavg m0, [dstq] > %%pavg m1, [dstq+d%3] > %%pavg m2, [dstq+d%4] > +%if %2 == 4 > + %%srcfn m4, [dstq+d%5] > + %%pavg m3, m4 > +%else > %%pavg m3, [dstq+d%5] > +%endif > %if %2/mmsize == 8 > %%pavg m4, [dstq+mmsize*4] > %%pavg m5, [dstq+mmsize*5] > -- > 2.34.1 > Merged. Ronald _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-06-01 18:32 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20220531123147.56064-1-rsbultje@gmail.com>
2022-05-31 12:41 ` [FFmpeg-devel] [PATCH] vp9: don't overread by 4 pixels in ff_vp9_avg4_mmxext() Ronald S. Bultje
2022-05-31 13:21 ` Ronald S. Bultje
2022-06-01 18:32 ` Ronald S. Bultje
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel This inbox may be cloned and mirrored by anyone: git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \ ffmpegdev@gitmailbox.com public-inbox-index ffmpegdev Example config snippet for mirrors. AGPL code for this site: git clone https://public-inbox.org/public-inbox.git