highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

msrledec: check bounds before constructing a possibly invalid pointer,

Browse Source 
CC:libav-stable@libav.org
This commit is contained in:
Anton Khirnov 2013-01-29 12:24:09 +01:00
parent 6a39985451
commit 9bd6375d5f
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/msrledec.c
View File

@ -144,8 +144,7 @@ static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic,
if(p1 == 0) { //Escape code if(p1 == 0) { //Escape code
p2 = bytestream2_get_byte(gb); p2 = bytestream2_get_byte(gb);
if(p2 == 0) { //End-of-line if(p2 == 0) { //End-of-line
output = pic->data[0] + (--line) * pic->linesize[0]; if (--line < 0) {
if (line < 0) {
if (bytestream2_get_be16(gb) == 1) { // end-of-picture if (bytestream2_get_be16(gb) == 1) { // end-of-picture
return 0; return 0;
} else { } else {
@ -155,6 +154,7 @@ static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic,
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
} }
output = pic->data[0] + line * pic->linesize[0];
pos = 0; pos = 0;
continue; continue;
} else if(p2 == 1) { //End-of-picture } else if(p2 == 1) { //End-of-picture