[FFmpeg-devel] [PATCH] bink: prevent overflows within binkidct by using int-sized intermediate array

[Peter Ross]

---
 libavcodec/binkidct.c           |    6 +++---
 tests/ref/fate/bink-demux-video |    8 ++++----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/libavcodec/binkidct.c b/libavcodec/binkidct.c
index 160926e..ddb6cc1 100644
--- a/libavcodec/binkidct.c
+++ b/libavcodec/binkidct.c
@@ -62,7 +62,7 @@
 #define MUNGE_ROW(x) (((x) + 0x7F)>>8)
 #define IDCT_ROW(dest,src) IDCT_TRANSFORM(dest,0,1,2,3,4,5,6,7,0,1,2,3,4,5,6,7,MUNGE_ROW,src)
 
-static inline void bink_idct_col(DCTELEM *dest, const DCTELEM *src)
+static inline void bink_idct_col(int *dest, const DCTELEM *src)
 {
     if ((src[8]|src[16]|src[24]|src[32]|src[40]|src[48]|src[56])==0) {
         dest[0]  =
@@ -81,7 +81,7 @@ static inline void bink_idct_col(DCTELEM *dest, const DCTELEM *src)
 void ff_bink_idct_c(DCTELEM *block)
 {
     int i;
-    DCTELEM temp[64];
+    int temp[64];
 
     for (i = 0; i < 8; i++)
         bink_idct_col(&temp[i], &block[i]);
@@ -103,7 +103,7 @@ void ff_bink_idct_add_c(uint8_t *dest, int linesize, DCTELEM *block)
 void ff_bink_idct_put_c(uint8_t *dest, int linesize, DCTELEM *block)
 {
     int i;
-    DCTELEM temp[64];
+    int temp[64];
     for (i = 0; i < 8; i++)
         bink_idct_col(&temp[i], &block[i]);
     for (i = 0; i < 8; i++) {
diff --git a/tests/ref/fate/bink-demux-video b/tests/ref/fate/bink-demux-video
index 22fb3c5..f3adf76 100644
--- a/tests/ref/fate/bink-demux-video
+++ b/tests/ref/fate/bink-demux-video
@@ -13,8 +13,8 @@
 0, 72000, 460800, 0x71c0f48e
 0, 78000, 460800, 0x5fc8f783
 0, 84000, 460800, 0xd23d336a
-0, 90000, 460800, 0xa7aca9e0
-0, 96000, 460800, 0x1dff2144
-0, 102000, 460800, 0x82cf8b2b
-0, 108000, 460800, 0x4cbe3544
+0, 90000, 460800, 0xadcfa9e0
+0, 96000, 460800, 0x24222144
+0, 102000, 460800, 0x88f28b2b
+0, 108000, 460800, 0x52e13544
 0, 114000, 460800, 0x7e724731
-- 
1.7.1


-- Peter
(A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature
URL: <http://lists.mplayerhq.hu/pipermail/ffmpeg-devel/attachments/20110213/aff549e3/attachment.pgp>