Unified · Split
| @@ -231,26 +231,24 @@ static int decode_rle(AVCodecContext *avctx, AVFrame *p, GetByteContext *gbc, · 230 unmodified lines | ||
| 231 | 231 | if (code & 0x80 ) { /* run */ |
| 232 | 232 | pix = bytestream2_get_byte(gbc); |
| 233 | 233 | for (j = 0; j < 257 - code; j++) { |
| 234 | − out[pos] = pix; | |
| 234 | + if (pos < offset) | |
| 235 | + out[pos] = pix; | |
| 235 | 236 | pos += step; |
| 236 | − if (pos >= offset) { | |
| 237 | + if (pos >= offset && step > 1) { | |
| 237 | 238 | pos -= offset; |
| 238 | 239 | pos++; |
| 239 | 240 | } |
| 240 | − if (pos >= offset) | |
| 241 | − return AVERROR_INVALIDDATA; | |
| 242 | 241 | } |
| 243 | 242 | left -= 2; |
| 244 | 243 | } else { /* copy */ |
| 245 | 244 | for (j = 0; j < code + 1; j++) { |
| 246 | − out[pos] = bytestream2_get_byte(gbc); | |
| 245 | + if (pos < offset) | |
| 246 | + out[pos] = bytestream2_get_byte(gbc); | |
| 247 | 247 | pos += step; |
| 248 | − if (pos >= offset) { | |
| 248 | + if (pos >= offset && step > 1) { | |
| 249 | 249 | pos -= offset; |
| 250 | 250 | pos++; |
| 251 | 251 | } |
| 252 | − if (pos >= offset) | |
| 253 | − return AVERROR_INVALIDDATA; | |
| 254 | 252 | } |
| 255 | 253 | left -= 2 + code; |
| 256 | 254 | } |