avcodec/sgidec: fix linesize for 16bit
authorMichael Niedermayer <michaelni@gmx.at>
Mon, 27 Oct 2014 19:48:58 +0000 (20:48 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Mon, 27 Oct 2014 20:16:54 +0000 (21:16 +0100)
Fixes: asan_heap-oob_22b30d4_39_038.sgi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3b20ed85489a14cb5028c873d06960dbc5eef88a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/sgidec.c

index 6f51ec3..8338863 100644 (file)
@@ -145,7 +145,7 @@ static int read_rle_sgi(uint8_t *out_buf, SgiState *s)
     for (z = 0; z < s->depth; z++) {
         dest_row = out_buf;
         for (y = 0; y < s->height; y++) {
-            linesize = s->width * s->depth * s->bytes_per_channel;
+            linesize = s->width * s->depth;
             dest_row -= s->linesize;
             start_offset = bytestream2_get_be32(&g_table);
             bytestream2_seek(&s->g, start_offset, SEEK_SET);