fix segfault (bug #1165640)
authorMichael Niedermayer <michaelni@gmx.at>
Mon, 11 Jul 2005 22:56:23 +0000 (22:56 +0000)
committerMichael Niedermayer <michaelni@gmx.at>
Mon, 11 Jul 2005 22:56:23 +0000 (22:56 +0000)
Originally committed as revision 4435 to svn://svn.ffmpeg.org/ffmpeg/trunk

libavcodec/8bps.c

index 3898ac5..4d5a64e 100644 (file)
@@ -100,11 +100,13 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, uint8
                        dlen = be2me_16(*(unsigned short *)(lp+row*2));
                        /* Decode a row of this plane */
                        while(dlen > 0) {
+                               if(dp + 1 >= buf+buf_size) return -1;
                                if ((count = *dp++) <= 127) {
                                        count++;
                                        dlen -= count + 1;
                                        if (pixptr + count * px_inc > pixptr_end)
                                            break;
+                                       if(dp + count > buf+buf_size) return -1;
                                        while(count--) {
                                                *pixptr = *dp++;
                                                pixptr += px_inc;