[FFmpeg-cvslog] avcodec/yuv4enc: do not read past end of input in case of odd height

[Paul B Mahol]

ffmpeg | branch: master | Paul B Mahol <onemda at gmail.com> | Wed Sep  6 02:27:56 2023 +0200| [d33c630b2a84365b465e66053f00d5660a3e22a3] | committer: Paul B Mahol

avcodec/yuv4enc: do not read past end of input in case of odd height

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d33c630b2a84365b465e66053f00d5660a3e22a3
---

 libavcodec/yuv4enc.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/libavcodec/yuv4enc.c b/libavcodec/yuv4enc.c
index 8123260d5d..2a9d3442ca 100644
--- a/libavcodec/yuv4enc.c
+++ b/libavcodec/yuv4enc.c
@@ -29,10 +29,10 @@ static int yuv4_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
 {
     uint8_t *dst;
     const uint8_t *y, *u, *v;
-    int i, j, ret;
+    int ret;
 
-    ret = ff_get_encode_buffer(avctx, pkt, 6 * (avctx->width  + 1 >> 1)
-                                             * (avctx->height + 1 >> 1), 0);
+    ret = ff_get_encode_buffer(avctx, pkt, 6 * ((avctx->width  + 1) / 2)
+                                             * ((avctx->height + 1) / 2), 0);
     if (ret < 0)
         return ret;
     dst = pkt->data;
@@ -41,8 +41,8 @@ static int yuv4_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
     u = pic->data[1];
     v = pic->data[2];
 
-    for (i = 0; i < avctx->height + 1 >> 1; i++) {
-        for (j = 0; j < avctx->width + 1 >> 1; j++) {
+    for (int i = 0; i < avctx->height / 2; i++) {
+        for (int j = 0; j < (avctx->width + 1) / 2; j++) {
             *dst++ = u[j] ^ 0x80;
             *dst++ = v[j] ^ 0x80;
             *dst++ = y[                   2 * j    ];
@@ -55,6 +55,17 @@ static int yuv4_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
         v +=     pic->linesize[2];
     }
 
+    if (avctx->height & 1) {
+        for (int j = 0; j < (avctx->width + 1) / 2; j++) {
+            *dst++ = u[j] ^ 0x80;
+            *dst++ = v[j] ^ 0x80;
+            *dst++ = y[2 * j    ];
+            *dst++ = y[2 * j + 1];
+            *dst++ = y[2 * j    ];
+            *dst++ = y[2 * j + 1];
+        }
+    }
+
     *got_packet = 1;
     return 0;
 }