yuvdeinterlace crash

"Steven M. Schultz" <[email protected]>
Newsgroups gmane.comp.video.mjpeg.devel
Message-ID <[email protected]>
Hi -

	Stefan - I think it's "back to the drawing board" :)

	I built mjpegtools today on a new MacBookPro (and fixed the cpuinfo.sh
	script to properly handle the 'Core2Duo' cpu) and yuvdeinterlace
	crashes immediately

	The crash is because a memcpy is being done with the destination being
	BEFORE the start of the allocated buffer.

	Memory is allocated like this:

	inframe[0] = (uint8_t *) malloc (luma_size + vertical_overshot_luma);
	outframe[0] = (uint8_t *) malloc (luma_size + vertical_overshot_luma);

	And referenced like this:

	temporal_reconstruct_frame (outframe[0], inframe[0], width, height, 0);

	The memcpy is at line 170

	memcpy (in - w, in + w, w);

	So 'in-w' is "w" bytes BEFORE the start of "inframe[0]"!

	Say we have a frame size of 720x480 

	If inframe[0] is, for example, a buffer starting at 10000 then
	'inframe[0] - 720' will be OUTSIDE the alloc'd memory - 10000 - 720
	or 9280.  That address is not part of the allocated memory!

	I commented out the two memcpy lines at 170 and 171 and yuvdeinterlace
	does not crash.

	The handling of the overshoot areas needs to be revisited.

	Have fun!

	Cheers,
	Steven Schultz


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.