lzw(gif): Fix overread
authorMichael Niedermayer <michaelni@gmx.at>
Wed, 28 Mar 2012 05:25:06 +0000 (07:25 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Wed, 28 Mar 2012 05:36:56 +0000 (07:36 +0200)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/lzw.c

index 185a05d..2db0d67 100644 (file)
@@ -101,7 +101,7 @@ void ff_lzw_decode_tail(LZWState *p)
     struct LZWState *s = (struct LZWState *)p;
 
     if(s->mode == FF_LZW_GIF) {
-        while(s->pbuf < s->ebuf && s->bs>0){
+        while(s->pbuf + s->bs < s->ebuf && s->bs>0){
             s->pbuf += s->bs;
             s->bs = *s->pbuf++;
         }