From 3f5b9c4c8b8e31fb833dce99dfe6539e76d3be44 Mon Sep 17 00:00:00 2001 From: Luis de Bethencourt Date: Fri, 10 Oct 2014 18:49:29 +0100 Subject: [PATCH] videoblend: Avoid assigning a negative value to a guint There are some few but certain conditions where it is possible for the dest_width to be smaller than x. So we check this before assigning a negative value to src_width, which is a unsigned and would be promoted to a number that can segfault videoblend. https://bugzilla.gnome.org/show_bug.cgi?id=738242 --- gst-libs/gst/video/video-blend.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/gst-libs/gst/video/video-blend.c b/gst-libs/gst/video/video-blend.c index 835b7bbdc2..7aa7173ddb 100644 --- a/gst-libs/gst/video/video-blend.c +++ b/gst-libs/gst/video/video-blend.c @@ -325,10 +325,12 @@ gst_video_blend (GstVideoFrame * dest, /* adjust width/height if the src is bigger than dest */ if (x + src_width > dest_width) - src_width = dest_width - x; + if (dest_width > x) + src_width = dest_width - x; if (y + src_height > dest_height) - src_height = dest_height - y; + if (dest_height > y) + src_height = dest_height - y; /* Mainloop doing the needed conversions, and blending */ for (i = y; i < y + src_height; i++) {