diff options
| author | Kostya Shishkov <kostya.shishkov@gmail.com> | 2009-05-16 06:39:08 +0000 |
|---|---|---|
| committer | Kostya Shishkov <kostya.shishkov@gmail.com> | 2009-05-16 06:39:08 +0000 |
| commit | b3867c93d10b42dae1aeb1e8fa6059c5b87c28a5 (patch) | |
| tree | b974f93545b32f3b48bce9a231512385196da612 /libavcodec/msrledec.c | |
| parent | 2d5fabc87a0cbd2ea8631855bc26b26fc376e983 (diff) | |
| download | ffmpeg-b3867c93d10b42dae1aeb1e8fa6059c5b87c28a5.tar.gz | |
Fix off-by-one error in MS RLE decoder which may result into writing past
picture buffer.
Originally committed as revision 18852 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/msrledec.c')
| -rw-r--r-- | libavcodec/msrledec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/msrledec.c b/libavcodec/msrledec.c index 40fec31278..1401ee3424 100644 --- a/libavcodec/msrledec.c +++ b/libavcodec/msrledec.c @@ -134,7 +134,7 @@ static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic, int de { uint8_t *output, *output_end; const uint8_t* src = data; - int p1, p2, line=avctx->height, pos=0, i; + int p1, p2, line=avctx->height - 1, pos=0, i; uint16_t av_uninit(pix16); uint32_t av_uninit(pix32); |