[FFmpeg-cvslog] r18899 - trunk/libavcodec/libtheoraenc.c

[David Conrad]

On May 23, 2009, at 4:07 AM, Reimar D?ffinger wrote:

> On Sat, May 23, 2009 at 12:01:50AM +0200, conrad wrote:
>> @@ -186,8 +186,8 @@ static int encode_frame(
>>         return -1;
>>     }
>>
>> -    t_yuv_buffer.y_width = avc_context->width;
>> -    t_yuv_buffer.y_height = avc_context->height;
>> +    t_yuv_buffer.y_width = FFALIGN(avc_context->width, 16);
>> +    t_yuv_buffer.y_height = FFALIGN(avc_context->height, 16);
>>     t_yuv_buffer.y_stride = frame->linesize[0];
>
>
> Are you sure this will not overread with e.g.
> avc_context->width = 1;
> avc_context->height = 1;
> t_yuv_buffer.y_stride = 8;
> ?
> I.e. a user-provided buffer that may have less alignment than lavc  
> uses?
> Or do we have restrictions on that which I did not find in a quick  
> look
> at the documentation?

Alignment-wise, I think a lot of stuff assumes luma lines will be 16- 
byte aligned, though the only requirement I can find is in the  
avcodec_decode_audio3/video2 doxy which only puts it as a requirement  
for some CPUs. Still, if it reads into the next line it doesn't matter  
much; libtheora won't modify the data.

Overreading height I'm not so sure about; what does the mpeg*video  
encoder do in this situation? If this isn't safe I guess the solution  
is to allocate an internal buffer to copy user-allocated buffers into.