diff options
| author | Anton Khirnov <anton@khirnov.net> | 2013-01-29 12:24:09 +0100 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2013-03-17 07:37:06 +0100 |
| commit | 4160398e2a3e229e29dff03300aaf630e726a768 (patch) | |
| tree | 480e9ecd9891d9a0287a721b154fb884e7916b82 | |
| parent | 327ff82bac3081d918dceb4931c77e25d0a1480d (diff) | |
| download | ffmpeg-4160398e2a3e229e29dff03300aaf630e726a768.tar.gz | |
msrledec: check bounds before constructing a possibly invalid pointer,
CC:libav-stable@libav.org
(cherry picked from commit 9bd6375d5f16842306dcecde637ffe605acda26b)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit b7765d00f911fe0f8fcda21b93a540f27d2ba2f5)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavcodec/msrledec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/msrledec.c b/libavcodec/msrledec.c index 003122e4f0..821311b6c8 100644 --- a/libavcodec/msrledec.c +++ b/libavcodec/msrledec.c @@ -144,8 +144,7 @@ static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic, if(p1 == 0) { //Escape code p2 = bytestream2_get_byte(gb); if(p2 == 0) { //End-of-line - output = pic->data[0] + (--line) * pic->linesize[0]; - if (line < 0) { + if (--line < 0) { if (bytestream2_get_be16(gb) == 1) { // end-of-picture return 0; } else { @@ -155,6 +154,7 @@ static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic, return AVERROR_INVALIDDATA; } } + output = pic->data[0] + line * pic->linesize[0]; pos = 0; continue; } else if(p2 == 1) { //End-of-picture |