diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-12-01 23:20:48 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-12-02 00:48:07 +0100 |
| commit | 77693c541a541661357a0edd5bbaae69c64b2039 (patch) | |
| tree | 90de552a516af2532d85dd932397c7b847e04f35 | |
| parent | 196920060b52c1de528447a0fe9d52e997fb0ed2 (diff) | |
| download | ffmpeg-77693c541a541661357a0edd5bbaae69c64b2039.tar.gz | |
xxan: more complete ybuf checks, fix out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/xxan.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavcodec/xxan.c b/libavcodec/xxan.c index 2c33f07a71..47b3544b05 100644 --- a/libavcodec/xxan.c +++ b/libavcodec/xxan.c @@ -276,7 +276,8 @@ static int xan_decode_frame_type0(AVCodecContext *avctx) ybuf[j+1] = cur << 1; last = cur; } - ybuf[j] = last << 1; + if(j < avctx->width) + ybuf[j] = last << 1; prev_buf = ybuf; ybuf += avctx->width; @@ -350,7 +351,8 @@ static int xan_decode_frame_type1(AVCodecContext *avctx) ybuf[j+1] = cur; last = cur; } - ybuf[j] = last; + if(j < avctx->width) + ybuf[j] = last; ybuf += avctx->width; } |