SAO: prevent stack buffer overflow for large bit depths.

Credit to OSS-Fuzz https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13643
strukturag · Apr 8, 2019 · 7db4e81 · 7db4e81
1 parent c172dd8
commit 7db4e81
Showing 1 changed file with 12 additions and 6 deletions.
diff --git a/libde265/sao.cc b/libde265/sao.cc
@@ -211,11 +211,14 @@ void apply_sao_internal(de265_image* img, int xCtb,int yCtb,
             continue;
           }
 
-          int bandIdx = bandTable[ in_img[xC+i+(yC+j)*in_stride]>>bandShift ];
-
           // Shifts are a strange thing. On x86, >>x actually computes >>(x%64).
           // So we have to take care of large bandShifts.
-          if (bandShift>=8) { bandIdx=0; }
+          int bandIdx;
+          if (bandShift >= 8) {
+            bandIdx = 0;
+          } else {
+            bandIdx = bandTable[ in_img[xC+i+(yC+j)*in_stride]>>bandShift ];
+          }
 
           if (bandIdx>0) {
             int offset = saoinfo->saoOffsetVal[cIdx][bandIdx-1];
@@ -237,10 +240,13 @@ void apply_sao_internal(de265_image* img, int xCtb,int yCtb,
         for (int j=0;j<ctbH;j++)
           for (int i=0;i<ctbW;i++) {
 
-            int bandIdx = bandTable[ in_img[xC+i+(yC+j)*in_stride]>>bandShift ];
-
             // see above
-            if (bandShift>=8) { bandIdx=0; }
+            int bandIdx;
+            if (bandShift >= 8) {
+              bandIdx = 0;
+            } else {
+              bandIdx = bandTable[ in_img[xC+i+(yC+j)*in_stride]>>bandShift ];
+            }
 
             if (bandIdx>0) {
               int offset = saoinfo->saoOffsetVal[cIdx][bandIdx-1];