diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-09-25 23:03:08 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-09-25 23:03:08 +0200 |
| commit | 210a437e105fbd92f1dd9c2c82f4a5efd80ca8fd (patch) | |
| tree | cc8e853469bf8e2e26b08d086c11cd19132edcd4 /libavcodec/dsicinav.c | |
| parent | 3308b443f9342cd597a9d7440d2315f0a65b1566 (diff) | |
| parent | 54e03863691dcae73260f70108b3731b70773e7c (diff) | |
| download | ffmpeg-210a437e105fbd92f1dd9c2c82f4a5efd80ca8fd.tar.gz | |
Merge commit '54e03863691dcae73260f70108b3731b70773e7c' into release/0.10
* commit '54e03863691dcae73260f70108b3731b70773e7c':
vc1: check the source buffer in vc1_mc functions
bink: Bound check the quantization matrix.
xl: Make sure the width is valid
alsdec: Fix the clipping range
dsicinav: Bound-check the source buffer when needed
mov: Do not allow updating the time scale after it has been set
ac3dec: Don't consume more data than the actual input packet size
indeo: Reject impossible FRAMETYPE_NULL
Conflicts:
libavcodec/alsdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/dsicinav.c')
| -rw-r--r-- | libavcodec/dsicinav.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavcodec/dsicinav.c b/libavcodec/dsicinav.c index 89de99d9a9..88187bb35f 100644 --- a/libavcodec/dsicinav.c +++ b/libavcodec/dsicinav.c @@ -188,11 +188,13 @@ static void cin_decode_rle(const unsigned char *src, int src_size, unsigned char while (src < src_end && dst < dst_end) { code = *src++; if (code & 0x80) { + if (src >= src_end) + break; len = code - 0x7F; memset(dst, *src++, FFMIN(len, dst_end - dst)); } else { len = code + 1; - memcpy(dst, src, FFMIN(len, dst_end - dst)); + memcpy(dst, src, FFMIN3(len, dst_end - dst, src_end - src)); src += len; } dst += len; |