diff options
| author | Dmitry Kovalev <dkovalev@google.com> | 2014-01-29 22:02:24 -0800 |
|---|---|---|
| committer | Dmitry Kovalev <dkovalev@google.com> | 2014-01-29 22:02:24 -0800 |
| commit | 1bd69ac57f09c1bafc2629171f53c86bfdb469e2 (patch) | |
| tree | 1af760fcd9bae84e20d523974d5b9f1e9aafea29 /vp9/encoder/vp9_onyx_int.h | |
| parent | 376c5386a4b9a14d6fc66865e601057aac3e3fb7 (diff) | |
| download | libvpx-1bd69ac57f09c1bafc2629171f53c86bfdb469e2.tar libvpx-1bd69ac57f09c1bafc2629171f53c86bfdb469e2.tar.gz libvpx-1bd69ac57f09c1bafc2629171f53c86bfdb469e2.tar.bz2 libvpx-1bd69ac57f09c1bafc2629171f53c86bfdb469e2.zip | |
Fixing out of bounds access in frame_refs[] array.
Change-Id: I08f45573e0b2195c09fb6aecacb4c57431a711ea
Diffstat (limited to 'vp9/encoder/vp9_onyx_int.h')
| -rw-r--r-- | vp9/encoder/vp9_onyx_int.h | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/vp9/encoder/vp9_onyx_int.h b/vp9/encoder/vp9_onyx_int.h index 0a6aab902..d2f42dd3e 100644 --- a/vp9/encoder/vp9_onyx_int.h +++ b/vp9/encoder/vp9_onyx_int.h @@ -756,8 +756,10 @@ static int get_token_alloc(int mb_rows, int mb_cols) { static void set_ref_ptrs(VP9_COMMON *cm, MACROBLOCKD *xd, MV_REFERENCE_FRAME ref0, MV_REFERENCE_FRAME ref1) { - xd->block_refs[0] = &cm->frame_refs[ref0 - LAST_FRAME]; - xd->block_refs[1] = &cm->frame_refs[ref1 - LAST_FRAME]; + xd->block_refs[0] = &cm->frame_refs[ref0 >= LAST_FRAME ? ref0 - LAST_FRAME + : 0]; + xd->block_refs[1] = &cm->frame_refs[ref1 >= LAST_FRAME ? ref1 - LAST_FRAME + : 0]; } #ifdef __cplusplus |