sgidec: safer check for buffer overflow
authorPaul B Mahol <onemda@gmail.com>
Fri, 26 Jul 2013 21:53:54 +0000 (21:53 +0000)
committerPaul B Mahol <onemda@gmail.com>
Sat, 27 Jul 2013 12:00:25 +0000 (12:00 +0000)
Signed-off-by: Paul B Mahol <onemda@gmail.com>
libavcodec/sgidec.c

index a32620b..4f7f8ac 100644 (file)
@@ -58,7 +58,7 @@ static int expand_rle_row(SgiState *s, uint8_t *out_buf,
         }
 
         /* Check for buffer overflow. */
-        if (out_buf + pixelstride * (count - 1) >= out_end)
+        if (out_end - out_buf <= pixelstride * (count - 1))
             return AVERROR_INVALIDDATA;
 
         if (pixel & 0x80) {