diff options
| author | Dudemanguy <random342@airmail.cc> | 2023-07-29 22:03:49 -0500 |
|---|---|---|
| committer | sfan5 <sfan5@live.de> | 2023-07-30 20:06:20 +0200 |
| commit | b7bf5e619fc94ebea6dac6fff4336561fb221fbc (patch) | |
| tree | c965f1cb9ffa2668e9a326307806e7ca98811b42 /video | |
| parent | 1608059d64532e0461e3bec09b20a71802dcb2aa (diff) | |
| download | mpv-b7bf5e619fc94ebea6dac6fff4336561fb221fbc.tar.bz2 mpv-b7bf5e619fc94ebea6dac6fff4336561fb221fbc.tar.xz | |
draw_bmp: fix overflowing coordinates in mark_rcs
This is yet another unfortunate side effect of the width % SLICE_W == 0
special case. While looping through these rectangles, the rc->x1 value
on the final loop can be greater than the actual total width. This will
cause a buffer overflow if using the mp_draw_sub_overlay API. 2 of the
current VOs that use that work around it by adjusting the values
returned, but the better fix is to correct what's actually given in the
rectangles so you can safely use the values. As for the fix, it's simply
ensuring that rc->x1 doesn't extend beyond p->w with a MPCLAMP.
Previously, the code would always naively add SLICE_W (256) to rc->x0
which would easily extend past the actual width in many cases. The
adjustments in vo_vaapi and vo_dmabuf_wayland are dropped and in theory
vo_direct3d should work now since we can just trust the values given to
us in the rectangles. How nice.
Diffstat (limited to 'video')
| -rw-r--r-- | video/out/vo_dmabuf_wayland.c | 4 | ||||
| -rw-r--r-- | video/out/vo_vaapi.c | 4 |
2 files changed, 0 insertions, 8 deletions
diff --git a/video/out/vo_dmabuf_wayland.c b/video/out/vo_dmabuf_wayland.c index a43b0fd180..ef1f767c1b 100644 --- a/video/out/vo_dmabuf_wayland.c +++ b/video/out/vo_dmabuf_wayland.c @@ -565,10 +565,6 @@ static bool draw_osd(struct vo *vo, struct mp_image *cur, double pts) void *src = mp_image_pixel_ptr(osd, 0, rc.x0, rc.y0); void *dst = cur->planes[0] + rc.x0 * 4 + rc.y0 * cur->stride[0]; - // Avoid overflowing if we have this special case. - if (n == num_mod_rc - 1) - --rh; - memcpy_pic(dst, src, rw * 4, rh, cur->stride[0], osd->stride[0]); } diff --git a/video/out/vo_vaapi.c b/video/out/vo_vaapi.c index 09f425e26c..4cc6ded00f 100644 --- a/video/out/vo_vaapi.c +++ b/video/out/vo_vaapi.c @@ -684,10 +684,6 @@ static void draw_osd(struct vo *vo) int rw = mp_rect_w(*rc); int rh = mp_rect_h(*rc); - // reduce width of last slice to prevent overflow - if (n == num_mod_rc - 1) - rw = w - rc->x0; - void *src = mp_image_pixel_ptr(osd, 0, rc->x0, rc->y0); void *dst = vaimg.planes[0] + rc->y0 * vaimg.stride[0] + rc->x0 * 4; |