Author: tterribe
Date: 2008-10-16 05:44:05 -0700 (Thu, 16 Oct 2008)
New Revision: 15403
Modified:
trunk/theora/lib/dec/decode.c
Log:
Boundary case conditonals for strong deringing were backwards, leading to a
possible out-of-bounds access.
Fortunately, this particular test seems to have occurred so seldom in practice
that it never tripped valgrind.
Modified: trunk/theora/lib/dec/decode.c
===================================================================
--- trunk/theora/lib/dec/decode.c 2008-10-15 22:01:57 UTC (rev 15402)
+++ trunk/theora/lib/dec/decode.c 2008-10-16 12:44:05 UTC (rev 15403)
@@ -1728,7 +1728,7 @@
static void oc_dec_dering_frag_rows(oc_dec_ctx *_dec,th_img_plane *_img,
int _pli,int _fragy0,int _fragy_end){
- th_img_plane *iplane;
+ th_img_plane *iplane;
oc_fragment_plane *fplane;
oc_fragment *frag;
int *variance;
@@ -1760,10 +1760,10 @@
if(strong&&var>sthresh){
oc_dering_block(idata+x,iplane->stride,b,
_dec->pp_dc_scale[qi],_dec->pp_sharp_mod[qi],1);
- if(_pli||(b&1)&&*(variance-1)>OC_DERING_THRESH4||
- (b&2)&&variance[1]>OC_DERING_THRESH4||
- (b&4)&&*(variance-fplane->nvfrags)>OC_DERING_THRESH4||
- (b&8)&&variance[fplane->nvfrags]>OC_DERING_THRESH4){
+ if(_pli||!(b&1)&&*(variance-1)>OC_DERING_THRESH4||
+ !(b&2)&&variance[1]>OC_DERING_THRESH4||
+ !(b&4)&&*(variance-fplane->nvfrags)>OC_DERING_THRESH4||
+ !(b&8)&&variance[fplane->nvfrags]>OC_DERING_THRESH4){
oc_dering_block(idata+x,iplane->stride,b,
_dec->pp_dc_scale[qi],_dec->pp_sharp_mod[qi],1);
oc_dering_block(idata+x,iplane->stride,b,