diff mbox series

[tvtime,4/4] Fix out of bounds access in MMX scanline blit

Message ID 20250615153751.1707298-5-tasos@tasossah.com
State New
Headers show
Series Resolve various memory-related issues | expand

Commit Message

Tasos Sahanidis June 15, 2025, 3:21 p.m. UTC
There are three loops in
quarter_blit_vertical_packed422_scanline_mmxext().

The first one processes the scanline in chunks of 16. The width is then
masked to process the remaining pixels in chunks of 4. It is then
masked again to process any remaining pixels.

The last mask is set incorrectly, which results in the last loop
running even if all pixels have been processed by the previous one.

Resolve it by setting the correct mask (divisor - 1) for the last loop.

Signed-off-by: Tasos Sahanidis <tasos@tasossah.com>
---
 src/speedy.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/src/speedy.c b/src/speedy.c
index 2c85dc4..7883b86 100644
--- a/src/speedy.c
+++ b/src/speedy.c
@@ -1617,7 +1617,7 @@  static void quarter_blit_vertical_packed422_scanline_mmxext( uint8_t *output, ui
         one += 8;
         three += 8;
     }
-    width = width & 0x7;
+    width = width & 0x3;
 
     /* Handle last few pixels. */
     for( i = width * 2; i; --i ) {