Fixes out of array read
Fixes: asan_heap-oob_20b0a06_1962_cov_1907976991_delete_node_small.png
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
/* would write off the end of the array if we let it process
* the last pixel with bpp=3 */
int w = bpp == 4 ? size : size - 3;
- dsp->add_paeth_prediction(dst + i, src + i, last + i, w - i, bpp);
- i = w;
+ if (w > i) {
+ dsp->add_paeth_prediction(dst + i, src + i, last + i, w - i, bpp);
+ i = w;
+ }
}
ff_add_png_paeth_prediction(dst + i, src + i, last + i, size - i, bpp);
break;