mirrors/FreeRDP
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

codec/nsc: fix memory corruption in case of chroma subsampling

Browse Source 
For odd number of rows, the memory copy operation was broken: after exiting
the loop, yplane points to the end of the last row data, and thus (yplane +
rw) points *after* the end of the last row.
This commit is contained in:
KOVACS Krisztian 2017-11-07 13:52:09 +01:00
parent 5189814930
commit d396258866
2 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libfreerdp/codec/nsc_encode.c
View File

@ -237,9 +237,13 @@ static void nsc_encode_argb_to_aycocg(NSC_CONTEXT* context, const BYTE* data,
if (context->ChromaSubsamplingLevel && (y % 2) == 1)
{
CopyMemory(yplane + rw, yplane, rw);
CopyMemory(coplane + rw, coplane, rw);
CopyMemory(cgplane + rw, cgplane, rw);
yplane = context->priv->PlaneBuffers[0] + y * rw;
coplane = context->priv->PlaneBuffers[1] + y * rw;
cgplane = context->priv->PlaneBuffers[2] + y * rw;
CopyMemory(yplane, yplane - rw, rw);
CopyMemory(coplane, coplane - rw, rw);
CopyMemory(cgplane, cgplane - rw, rw);
}
}

10
libfreerdp/codec/nsc_sse2.c
View File

@ -326,9 +326,13 @@ static void nsc_encode_argb_to_aycocg_sse2(NSC_CONTEXT* context,
if (context->ChromaSubsamplingLevel > 0 && (y % 2) == 1)
{
CopyMemory(yplane + rw, yplane, rw);
CopyMemory(coplane + rw, coplane, rw);
CopyMemory(cgplane + rw, cgplane, rw);
yplane = context->priv->PlaneBuffers[0] + y * rw;
coplane = context->priv->PlaneBuffers[1] + y * rw;
cgplane = context->priv->PlaneBuffers[2] + y * rw;
CopyMemory(yplane, yplane - rw, rw);
CopyMemory(coplane, coplane - rw, rw);
CopyMemory(cgplane, cgplane - rw, rw);
}
}