shithub: openh264

Download patch

ref: b9de87ea5dd00c691d9c7a56d2d5bd63afe734d2
parent: ba7dca89d5c2a566a43b6bec2c3f2755a0e4bb90
parent: 292d78db5c5c12fc97fcd48e73a75e8e637c15a1
author: dongzha <dongzha@cisco.com>
date: Wed Jul 2 21:42:43 EDT 2014 

Merge pull request #1077 from mstorsjo/fix-test-out-of-bounds-access

Avoid writing in array index [-1] in DecUT_IntraPrediction


--- a/test/decoder/DecUT_IntraPrediction.cpp
+++ b/test/decoder/DecUT_IntraPrediction.cpp
@@ -391,15 +391,15 @@
 } \
 while(iRunTimes--) {\
 for (int i = 0; i < 17; i ++) {\
-  pRefBuffer[i] = pPredBuffer[i] = rand() & 255; \
-  pRefBuffer[i * kiStride - 1] = pPredBuffer[i * kiStride - 1] = rand() & 255; \
+  pRefBuffer[kiStride + i] = pPredBuffer[kiStride + i] = rand() & 255; \
+  pRefBuffer[(i+1) * kiStride - 1] = pPredBuffer[(i+1) * kiStride - 1] = rand() & 255; \
 }\
-pred(&pPredBuffer[kiStride], kiStride); \
-ref(&pRefBuffer[kiStride], kiStride); \
+pred(&pPredBuffer[2*kiStride], kiStride); \
+ref(&pRefBuffer[2*kiStride], kiStride); \
 bool ok = true; \
 for (int i = 0; i < 8; i ++)\
   for(int j = 0; j < 8; j ++)\
-    if (pPredBuffer[(i+1) * kiStride + j] != pRefBuffer[(i+1) * kiStride + j]) {\
+    if (pPredBuffer[(i+2) * kiStride + j] != pRefBuffer[(i+2) * kiStride + j]) {\
       ok = false; \
       break; \
     } \
@@ -528,15 +528,15 @@
 }\
 while(iRunTimes--) {\
 for (int i = 0; i < 17; i ++) {\
-  pRefBuffer[i] = pPredBuffer[i] = rand() & 255; \
-  pRefBuffer[i * kiStride - 1] = pPredBuffer[i * kiStride - 1] = rand() & 255; \
+  pRefBuffer[kiStride + i] = pPredBuffer[kiStride + i] = rand() & 255; \
+  pRefBuffer[(i+1) * kiStride - 1] = pPredBuffer[(i+1) * kiStride - 1] = rand() & 255; \
 }\
-pred(&pPredBuffer[kiStride], kiStride); \
-ref(&pRefBuffer[kiStride], kiStride); \
+pred(&pPredBuffer[2*kiStride], kiStride); \
+ref(&pRefBuffer[2*kiStride], kiStride); \
 bool ok = true; \
 for (int i = 0; i < 16; i ++)\
   for(int j = 0; j < 16; j ++)\
-    if (pPredBuffer[(i+1) * kiStride + j] != pRefBuffer[(i+1) * kiStride + j]) {\
+    if (pPredBuffer[(i+2) * kiStride + j] != pRefBuffer[(i+2) * kiStride + j]) {\
       ok = false; \
       break; \
     } \