[libbluray-devel] BDGraphics.drawResizeBilinear(): Fix reading outside of source image

[Ian Curtis]

libbluray | branch: master | Ian Curtis <i.curtis at gmail.com> | Mon Oct 20 13:56:24 2014 +0300| [35bf6ecad7c365aedde7355e62cc5a9ba77c3af9] | committer: hpi1

BDGraphics.drawResizeBilinear(): Fix reading outside of source image

> http://git.videolan.org/gitweb.cgi/libbluray.git/?a=commit;h=35bf6ecad7c365aedde7355e62cc5a9ba77c3af9
---

 src/libbluray/bdj/java/java/awt/BDGraphicsBase.java |   15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/src/libbluray/bdj/java/java/awt/BDGraphicsBase.java b/src/libbluray/bdj/java/java/awt/BDGraphicsBase.java
index 4f0890e..0d76ea7 100644
--- a/src/libbluray/bdj/java/java/awt/BDGraphicsBase.java
+++ b/src/libbluray/bdj/java/java/awt/BDGraphicsBase.java
@@ -1098,6 +1098,21 @@ abstract class BDGraphicsBase extends Graphics2D implements ConstrainableGraphic
     private void drawResizeBilinear(int[] pixels, int offset, int scansize, int sw, int sh,
                                     int dx, int dy, int dw, int dh, boolean flipX, boolean flipY) {
 
+        if (sh == 1) {
+            // crop source width if needed for 1d arrays
+            if (offset + sw > pixels.length) {
+                sw = (pixels.length - offset);
+            }
+        } else {
+            // crop source height to prevent possible over reads
+            if (offset + (scansize*sh) > pixels.length) {
+                sh = (pixels.length - offset) / scansize;
+            }
+        }
+        if (sw < 1 || sh < 1 || pixels.length < 1) {
+            return;
+        }
+
         if (sw == 1 && sh == 1) {
             for (int Y = dy; Y < (dy + dh); Y++)
                 drawSpan(dx, Y, dw, pixels[offset]);