diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-24 02:05:50 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-03-24 03:26:51 +0100 |
| commit | ba775a54bc2136ec5da85385a923b05ee6fab159 (patch) | |
| tree | 934894693e1ad95300fcd39bd03df2b55174b35b /libavcodec/indeo3.c | |
| parent | 59a4b73531428d2f420b4dad545172c8483ced0f (diff) | |
| download | ffmpeg-ba775a54bc2136ec5da85385a923b05ee6fab159.tar.gz | |
indeo3: fix out of picture write.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/indeo3.c')
| -rw-r--r-- | libavcodec/indeo3.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/indeo3.c b/libavcodec/indeo3.c index 7038cac3c6..b6ae2eaf03 100644 --- a/libavcodec/indeo3.c +++ b/libavcodec/indeo3.c @@ -419,8 +419,8 @@ static int decode_cell_data(Cell *cell, uint8_t *block, uint8_t *ref_block, blk_row_offset = (row_offset << (2 + v_zoom)) - (cell->width << 2); line_offset = v_zoom ? row_offset : 0; - for (y = 0; y < cell->height; is_first_row = 0, y += 1 + v_zoom) { - for (x = 0; x < cell->width; x += 1 + h_zoom) { + for (y = 0; y + v_zoom < cell->height; is_first_row = 0, y += 1 + v_zoom) { + for (x = 0; x + h_zoom < cell->width; x += 1 + h_zoom) { ref = ref_block; dst = block; |