Skip to content

Fix out-of-bounds access in motion compensation - #10

Open
user-none wants to merge 1 commit into
gen2brain:mainfrom
user-none:fix-motion-compensation-bounds
Open

user-none wants to merge 1 commit into
gen2brain:mainfrom
user-none:fix-motion-compensation-bounds

Conversation

@user-none

Copy link
Copy Markdown

A malformed stream can make the assembly motion compensation read or write outside the frame buffers. Two inputs cause it: a macroblock address of -1 at the start of a slice, or a motion vector pointing outside the reference frame. In the noasm build the same input panics.

copyMacroblock now checks the block is inside the frame before calling the backend and skips it otherwise. decodeMacroblock now rejects a negative macroblock address. Tests cover out-of-range positions and vectors, plus valid half-pel reads at the frame edge.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant