From 78556b82a67ce2a7a846358fdad8f625ce38401a Mon Sep 17 00:00:00 2001
From: Kostya Shishkov <kostya.shishkov@gmail.com>
Date: Tue, 14 Dec 2021 12:47:17 +0100
Subject: [PATCH] zmbv: fix out-of-bounds motion compensation

---
 nihav-commonfmt/src/codecs/zmbv.rs    | 10 +++++-----
 nihav-commonfmt/src/codecs/zmbvenc.rs |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/nihav-commonfmt/src/codecs/zmbv.rs b/nihav-commonfmt/src/codecs/zmbv.rs
index c53f76a..471f47e 100644
--- a/nihav-commonfmt/src/codecs/zmbv.rs
+++ b/nihav-commonfmt/src/codecs/zmbv.rs
@@ -104,15 +104,15 @@ fn decode_inter(frm: &mut [u8], prev: &[u8], dpal: bool, pal: &mut [u8; 768], pp
                 }
             } else {
                 let mut doff = off;
-                let mut soff = (off as isize) + xoff + yoff * (stride as isize);
+                let mut soff = xoff * (pparms.bpp as isize) + yoff * (stride as isize);
                 for j in 0..cur_h {
                     let cy = yoff + (j as isize);
-                    if cy >= 0 && (cy as usize) + cur_h <= pparms.height {
+                    if cy >= 0 && (cy as usize) < pparms.height {
                         for i in 0..cur_w {
                             let cx = xoff + (i as isize);
-                            if cx >= 0 && (cx as usize) + cur_w <= pparms.width {
+                            if cx >= 0 && (cx as usize) < pparms.width {
                                 for k in 0..pparms.bpp {
-                                    frm[doff + i * pparms.bpp + k] = prev[(soff + ((i * pparms.bpp + k) as isize) + ((j * stride) as isize)) as usize]
+                                    frm[doff + i * pparms.bpp + k] = prev[(soff + ((i * pparms.bpp + k) as isize)) as usize]
                                 }
                             } else {
                                 for k in 0..pparms.bpp {
@@ -328,7 +328,7 @@ mod test {
         let mut dec_reg = RegisteredDecoders::new();
         generic_register_all_decoders(&mut dec_reg);
         test_decoding("avi", "zmbv", "assets/Misc/td3_000.avi", Some(10),
-                     &dmx_reg, &dec_reg, ExpectedTestResult::MD5([0x90f431d3, 0x66336a2b, 0x113fd806, 0x8d53da95]));
+                     &dmx_reg, &dec_reg, ExpectedTestResult::MD5([0x83c57ac3, 0xda325d18, 0x806bd3be, 0x4b108732]));
     }
     #[test]
     fn test_zmbv_15() {
diff --git a/nihav-commonfmt/src/codecs/zmbvenc.rs b/nihav-commonfmt/src/codecs/zmbvenc.rs
index c0d58fa..b3f75bf 100644
--- a/nihav-commonfmt/src/codecs/zmbvenc.rs
+++ b/nihav-commonfmt/src/codecs/zmbvenc.rs
@@ -594,7 +594,7 @@ mod test {
             ];
         //test_encoding_to_file(&dec_config, &enc_config, enc_params, enc_options);
         test_encoding_md5(&dec_config, &enc_config, enc_params, enc_options,
-                          &[0x4bcdb816, 0x57d5d1b6, 0xc9412438, 0x9416c407]);
+                          &[0x08615111, 0x6f644a35, 0xa4e28f32, 0x35d2e66c]);
     }
 
     #[test]
-- 
2.30.2