diff options
| author | Alex Beregszaszi <alex@rtfs.hu> | 2006-11-14 19:19:13 +0000 |
|---|---|---|
| committer | Alex Beregszaszi <alex@rtfs.hu> | 2006-11-14 19:19:13 +0000 |
| commit | d8b45f7961dd7ad73fbe703f5b7ab600c876cde3 (patch) | |
| tree | 3157b031650577866ac84c285acc4b82e01f734b | |
| parent | eda70b4276f9577dc059ca47386c90fed924df62 (diff) | |
| download | ffmpeg-d8b45f7961dd7ad73fbe703f5b7ab600c876cde3.tar.gz | |
Fix possible overflows. Found by Steven Johnson
Originally committed as revision 7065 to svn://svn.ffmpeg.org/ffmpeg/trunk
| -rw-r--r-- | libavcodec/flicvideo.c | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/libavcodec/flicvideo.c b/libavcodec/flicvideo.c index f53aabfad9..0e6f5bdcec 100644 --- a/libavcodec/flicvideo.c +++ b/libavcodec/flicvideo.c @@ -156,7 +156,7 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx, int starting_line; signed short line_packets; int y_ptr; - signed char byte_run; + int byte_run; int pixel_skip; int pixel_countdown; unsigned char *pixels; @@ -258,7 +258,7 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx, pixel_skip = buf[stream_ptr++]; pixel_ptr += pixel_skip; pixel_countdown -= pixel_skip; - byte_run = buf[stream_ptr++]; + byte_run = (signed char)(buf[stream_ptr++]); if (byte_run < 0) { byte_run = -byte_run; palette_idx1 = buf[stream_ptr++]; @@ -301,7 +301,7 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx, pixel_skip = buf[stream_ptr++]; pixel_ptr += pixel_skip; pixel_countdown -= pixel_skip; - byte_run = buf[stream_ptr++]; + byte_run = (signed char)(buf[stream_ptr++]); if (byte_run > 0) { CHECK_PIXEL_PTR(byte_run); for (j = 0; j < byte_run; j++, pixel_countdown--) { @@ -341,7 +341,7 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx, stream_ptr++; pixel_countdown = s->avctx->width; while (pixel_countdown > 0) { - byte_run = buf[stream_ptr++]; + byte_run = (signed char)(buf[stream_ptr++]); if (byte_run > 0) { palette_idx1 = buf[stream_ptr++]; CHECK_PIXEL_PTR(byte_run); @@ -443,7 +443,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx, int compressed_lines; signed short line_packets; int y_ptr; - signed char byte_run; + int byte_run; int pixel_skip; int pixel_countdown; unsigned char *pixels; @@ -503,7 +503,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx, pixel_skip = buf[stream_ptr++]; pixel_ptr += (pixel_skip*2); /* Pixel is 2 bytes wide */ pixel_countdown -= pixel_skip; - byte_run = buf[stream_ptr++]; + byte_run = (signed char)(buf[stream_ptr++]); if (byte_run < 0) { byte_run = -byte_run; pixel = LE_16(&buf[stream_ptr]); @@ -549,7 +549,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx, pixel_countdown = (s->avctx->width * 2); while (pixel_countdown > 0) { - byte_run = buf[stream_ptr++]; + byte_run = (signed char)(buf[stream_ptr++]); if (byte_run > 0) { palette_idx1 = buf[stream_ptr++]; CHECK_PIXEL_PTR(byte_run); @@ -603,7 +603,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx, pixel_countdown = s->avctx->width; /* Width is in pixels, not bytes */ while (pixel_countdown > 0) { - byte_run = buf[stream_ptr++]; + byte_run = (signed char)(buf[stream_ptr++]); if (byte_run > 0) { pixel = LE_16(&buf[stream_ptr]); stream_ptr += 2; |