faxcompr: Dont read ref when the end has been reached in pass mode
authorMichael Niedermayer <michaelni@gmx.at>
Tue, 12 Feb 2013 21:14:50 +0000 (22:14 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Tue, 12 Feb 2013 21:55:44 +0000 (22:55 +0100)
Fixes reading over the end

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/faxcompr.c

index 3e51a3e..86be977 100644 (file)
@@ -170,10 +170,12 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb,
             return -1;
         }
         if(!cmode){//pass mode
-            run_off += *ref++;
+            if(run_off < width)
+                run_off += *ref++;
             run = run_off - offs;
             offs= run_off;
-            run_off += *ref++;
+            if(run_off < width)
+                run_off += *ref++;
             if(offs > width){
                 av_log(avctx, AV_LOG_ERROR, "Run went out of bounds\n");
                 return -1;