fix segfault (bug #1165640)
Originally committed as revision 4435 to svn://svn.ffmpeg.org/ffmpeg/trunk
This commit is contained in:
@@ -100,11 +100,13 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, uint8
|
|||||||
dlen = be2me_16(*(unsigned short *)(lp+row*2));
|
dlen = be2me_16(*(unsigned short *)(lp+row*2));
|
||||||
/* Decode a row of this plane */
|
/* Decode a row of this plane */
|
||||||
while(dlen > 0) {
|
while(dlen > 0) {
|
||||||
|
if(dp + 1 >= buf+buf_size) return -1;
|
||||||
if ((count = *dp++) <= 127) {
|
if ((count = *dp++) <= 127) {
|
||||||
count++;
|
count++;
|
||||||
dlen -= count + 1;
|
dlen -= count + 1;
|
||||||
if (pixptr + count * px_inc > pixptr_end)
|
if (pixptr + count * px_inc > pixptr_end)
|
||||||
break;
|
break;
|
||||||
|
if(dp + count > buf+buf_size) return -1;
|
||||||
while(count--) {
|
while(count--) {
|
||||||
*pixptr = *dp++;
|
*pixptr = *dp++;
|
||||||
pixptr += px_inc;
|
pixptr += px_inc;
|
||||||
|
|||||||
Reference in New Issue
Block a user