FS-7500: be safe for patch and fill, off by 1

diff --git a/src/switch_core_video.c b/src/switch_core_video.c
index a1bed8cf7bc0f339a65878d7ca46f36de239df9f..9021336d027677a2b05be61634d76e937a2905cd 100644 (file)
--- a/src/switch_core_video.c
+++ b/src/switch_core_video.c
@@ -97,11 +97,11 @@ SWITCH_DECLARE(void) switch_img_patch(switch_image_t *IMG, switch_image_t *img,
        if (y & 0x1) y++;
        if (len <= 0) return;
 
-       for (i = y; i < (y + img->d_h) && i < IMG->d_h; i++) {
+       for (i = y; i < max_h; i++) {
                memcpy(IMG->planes[SWITCH_PLANE_Y] + IMG->stride[SWITCH_PLANE_Y] * i + x, img->planes[SWITCH_PLANE_Y] + img->stride[SWITCH_PLANE_Y] * (i - y), len);
        }
 
-       if ((len & 1) && (x + len) < img->d_w) len++;
+       if ((len & 1) && (x + len) < img->d_w - 1) len++;
 
        len /= 2;
 
@@ -201,11 +201,11 @@ SWITCH_DECLARE(void) switch_img_fill(switch_image_t *img, int x, int y, int w, i
        if (y & 1) y++;
        if (len <= 0) return;
 
-       for (i = y; i < (y + h) && i < img->d_h; i++) {
+       for (i = y; i < max_h; i++) {
                memset(img->planes[SWITCH_PLANE_Y] + img->stride[SWITCH_PLANE_Y] * i + x, yuv_color.y, len);
        }
 
-       if ((len & 1) && (x + len) < img->d_w) len++;
+       if ((len & 1) && (x + len) < img->d_w - 1) len++;
 
        len /= 2;