shithub: libvpx

Info  •  Files  •  Log  •  Branches

vp9/count_segs: fix out of bounds read

don't access mi until mi_{row,col} validation has been done

Change-Id: Ie1be052612cfccb2730dff9281c222bca28bf2c6

--- a/vp9/encoder/vp9_segmentation.c

+++ b/vp9/encoder/vp9_segmentation.c

@@ -123,11 +123,12 @@

                        int bw, int bh, int mi_row, int mi_col) {

   VP9_COMMON *const cm = &cpi->common;

   MACROBLOCKD *const xd = &cpi->mb.e_mbd;

-  const int segment_id = mi->mbmi.segment_id;

+  int segment_id;

   if (mi_row >= cm->mi_rows || mi_col >= cm->mi_cols)

     return;

+  segment_id = mi->mbmi.segment_id;

   xd->mode_info_context = mi;

   set_mi_row_col(cm, xd, mi_row, bh, mi_col, bw);