diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-02-12 22:14:50 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-02-12 22:55:44 +0100 |
| commit | 6f9ae391deeab618fc9c0080d05b97afa29ddf81 (patch) | |
| tree | 23666bb778f9b3e5af55e06ae0c7b38f36d8b944 /libavcodec | |
| parent | 1ac0fa50eff30d413206cffa5f47f7fe6d4849b1 (diff) | |
| download | ffmpeg-6f9ae391deeab618fc9c0080d05b97afa29ddf81.tar.gz | |
faxcompr: Dont read ref when the end has been reached in pass mode
Fixes reading over the end
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/faxcompr.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavcodec/faxcompr.c b/libavcodec/faxcompr.c index 3e51a3e793..86be97792e 100644 --- a/libavcodec/faxcompr.c +++ b/libavcodec/faxcompr.c @@ -170,10 +170,12 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb, return -1; } if(!cmode){//pass mode - run_off += *ref++; + if(run_off < width) + run_off += *ref++; run = run_off - offs; offs= run_off; - run_off += *ref++; + if(run_off < width) + run_off += *ref++; if(offs > width){ av_log(avctx, AV_LOG_ERROR, "Run went out of bounds\n"); return -1; |