sgidec: fix off by 1 error that tested a sample too far for oob.
authorMichael Niedermayer <michaelni@gmx.at>
Sun, 8 Jul 2012 23:31:41 +0000 (01:31 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sun, 8 Jul 2012 23:33:44 +0000 (01:33 +0200)
This led to decoding failure when linesize was too small.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/sgidec.c

index 4e8fd31..f11efd0 100644 (file)
@@ -58,7 +58,7 @@ static int expand_rle_row(SgiState *s, uint8_t *out_buf,
         }
 
         /* Check for buffer overflow. */
-        if(out_buf + pixelstride * count >= out_end) return -1;
+        if(out_buf + pixelstride * (count-1) >= out_end) return -1;
 
         if (pixel & 0x80) {
             while (count--) {