dvbsubdec: Fix variable increments & checking in dvbsub_read_*bit_string()
authorJULIAN GARDNER <joolzg@btinternet.com>
Fri, 14 Oct 2011 12:52:33 +0000 (14:52 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Fri, 14 Oct 2011 18:12:40 +0000 (20:12 +0200)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/dvbsubdec.c

index ad213c8..4b61126 100644 (file)
@@ -532,14 +532,14 @@ static int dvbsub_read_2bit_string(uint8_t *destbuf, int dbuf_len,
                             }
                         }
                     } else if (bits == 1) {
-                        pixels_read += 2;
                         if (map_table)
                             bits = map_table[0];
                         else
                             bits = 0;
-                        if (pixels_read <= dbuf_len) {
-                            *destbuf++ = bits;
+                        run_length = 2;
+                        while (run_length-- > 0 && pixels_read < dbuf_len) {
                             *destbuf++ = bits;
+                            pixels_read++;
                         }
                     } else {
                         (*srcbuf) += (get_bits_count(&gb) + 7) >> 3;
@@ -656,14 +656,14 @@ static int dvbsub_read_4bit_string(uint8_t *destbuf, int dbuf_len,
                             }
                         }
                     } else if (bits == 1) {
-                        pixels_read += 2;
                         if (map_table)
                             bits = map_table[0];
                         else
                             bits = 0;
-                        if (pixels_read <= dbuf_len) {
-                            *destbuf++ = bits;
+                        run_length = 2;
+                        while (run_length-- > 0 && pixels_read < dbuf_len) {
                             *destbuf++ = bits;
+                            pixels_read++;
                         }
                     } else {
                         if (map_table)