From 9faf03c91ef99b8672bccf82bb38736c1ad6450e Mon Sep 17 00:00:00 2001 From: Seven Du Date: Fri, 13 Feb 2015 14:28:28 +0800 Subject: [PATCH] FS-7500: be safe for patch and fill, off by 1 --- src/switch_core_video.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/switch_core_video.c b/src/switch_core_video.c index a1bed8cf7b..9021336d02 100644 --- a/src/switch_core_video.c +++ b/src/switch_core_video.c @@ -97,11 +97,11 @@ SWITCH_DECLARE(void) switch_img_patch(switch_image_t *IMG, switch_image_t *img, if (y & 0x1) y++; if (len <= 0) return; - for (i = y; i < (y + img->d_h) && i < IMG->d_h; i++) { + for (i = y; i < max_h; i++) { memcpy(IMG->planes[SWITCH_PLANE_Y] + IMG->stride[SWITCH_PLANE_Y] * i + x, img->planes[SWITCH_PLANE_Y] + img->stride[SWITCH_PLANE_Y] * (i - y), len); } - if ((len & 1) && (x + len) < img->d_w) len++; + if ((len & 1) && (x + len) < img->d_w - 1) len++; len /= 2; @@ -201,11 +201,11 @@ SWITCH_DECLARE(void) switch_img_fill(switch_image_t *img, int x, int y, int w, i if (y & 1) y++; if (len <= 0) return; - for (i = y; i < (y + h) && i < img->d_h; i++) { + for (i = y; i < max_h; i++) { memset(img->planes[SWITCH_PLANE_Y] + img->stride[SWITCH_PLANE_Y] * i + x, yuv_color.y, len); } - if ((len & 1) && (x + len) < img->d_w) len++; + if ((len & 1) && (x + len) < img->d_w - 1) len++; len /= 2;