Commit 6e13c30a authored by Ronald S. Bultje's avatar Ronald S. Bultje

vp9: don't overread by 4 pixels in ff_vp9_avg4_mmxext().

If the block is at the end of the allocated buffer and there is no
padding, this will over-read, which may cause crashes. Reported by
Firefox.
parent d42b410e
......@@ -604,7 +604,12 @@ cglobal vp9_%1%2 %+ %%szsuf, 5, 5, %8, dst, dstride, src, sstride, h
%%pavg m0, [dstq]
%%pavg m1, [dstq+d%3]
%%pavg m2, [dstq+d%4]
%if %2 == 4
%%srcfn m4, [dstq+d%5]
%%pavg m3, m4
%else
%%pavg m3, [dstq+d%5]
%endif
%if %2/mmsize == 8
%%pavg m4, [dstq+mmsize*4]
%%pavg m5, [dstq+mmsize*5]
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment