diff options
| author | Mathieu Malaterre <mathieu.malaterre@gmail.com> | 2008-07-31 14:53:14 +0000 |
|---|---|---|
| committer | Benoit Fouet <benoit.fouet@free.fr> | 2008-07-31 14:53:14 +0000 |
| commit | 0afdedcafb4d524abfe2c958f17aafe4f1ab8d9a (patch) | |
| tree | 4c98f6ecd8def0ab57075907458c4d8230722b18 /libavcodec/rle.c | |
| parent | ce1ee094d7f0b12565f659a3d298469b21fcf348 (diff) | |
| download | ffmpeg-0afdedcafb4d524abfe2c958f17aafe4f1ab8d9a.tar.gz | |
Fix a potential out of array writing.
Patch by Mathieu Malaterre mathieu malaterre gmail com
Originally committed as revision 14487 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/rle.c')
| -rw-r--r-- | libavcodec/rle.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/rle.c b/libavcodec/rle.c index 802f7f34a5..6e468f8991 100644 --- a/libavcodec/rle.c +++ b/libavcodec/rle.c @@ -70,9 +70,9 @@ int ff_rle_encode(uint8_t *outbuf, int out_size, const uint8_t *ptr , int bpp, i } else { /* fall back on uncompressed */ count = count_pixels(ptr, w-x, bpp, 0); + if(out + bpp*count >= outbuf + out_size) return -1; *out++ = (count ^ xor_raw) + add_raw; - if(out + bpp*count > outbuf + out_size) return -1; memcpy(out, ptr, bpp * count); out += bpp * count; } |