aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/dfa.c
diff options
context:
space:
mode:
authorRonald S. Bultje <rsbultje@gmail.com>2011-03-29 07:14:44 -0700
committerRonald S. Bultje <rsbultje@gmail.com>2011-03-29 07:14:44 -0700
commitd38345878cbb89e4d8d33bd79f47836d4e9cd637 (patch)
tree1a6e5a49dd3a0ac7a9d84dd8a273a3d9934e85bc /libavcodec/dfa.c
parenta75529e81ea14c6d7c449e205aef97a0acb2645f (diff)
downloadffmpeg-d38345878cbb89e4d8d33bd79f47836d4e9cd637.tar.gz
dfa: protect pointer range checks against overflows.
Diffstat (limited to 'libavcodec/dfa.c')
-rw-r--r--libavcodec/dfa.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/libavcodec/dfa.c b/libavcodec/dfa.c
index 1023197c38..b149791136 100644
--- a/libavcodec/dfa.c
+++ b/libavcodec/dfa.c
@@ -81,7 +81,7 @@ static int decode_tsw1(uint8_t *frame, int width, int height,
v = bytestream_get_le16(&src);
offset = (v & 0x1FFF) << 1;
count = ((v >> 13) + 2) << 1;
- if (frame - offset < frame_start || frame_end - frame < count)
+ if (frame - frame_start < offset || frame_end - frame < count)
return -1;
av_memcpy_backptr(frame, offset, count);
frame += count;
@@ -117,7 +117,7 @@ static int decode_dsw1(uint8_t *frame, int width, int height,
v = bytestream_get_le16(&src);
offset = (v & 0x1FFF) << 1;
count = ((v >> 13) + 2) << 1;
- if (frame - offset < frame_start || frame_end - frame < count)
+ if (frame - frame_start < offset || frame_end - frame < count)
return -1;
// can't use av_memcpy_backptr() since it can overwrite following pixels
for (v = 0; v < count; v++)
@@ -157,7 +157,7 @@ static int decode_dds1(uint8_t *frame, int width, int height,
v = bytestream_get_le16(&src);
offset = (v & 0x1FFF) << 2;
count = ((v >> 13) + 2) << 1;
- if (frame - offset < frame_start || frame_end - frame < count*2 + width)
+ if (frame - frame_start < offset || frame_end - frame < count*2 + width)
return -1;
for (i = 0; i < count; i++) {
frame[0] = frame[1] =