Showing the changes to libavcodec (1 of 1 file). Show all
Unified · Split
| @@ -231,26 +231,24 @@ static int decode_rle(AVCodecContext *avctx, AVFrame *p, GetByteContext *gbc, · 230 unmodified lines | |||
| 231 | if (code & 0x80 ) { /* run */ | 231 | if (code & 0x80 ) { /* run */ |
| 232 | pix = bytestream2_get_byte(gbc); | 232 | pix = bytestream2_get_byte(gbc); |
| 233 | for (j = 0; j < 257 - code; j++) { | 233 | for (j = 0; j < 257 - code; j++) { |
| 234 | out[pos] = pix; | 234 | if (pos < offset) |
| 235 | out[pos] = pix; | ||
| 235 | pos += step; | 236 | pos += step; |
| 236 | if (pos >= offset) { | 237 | if (pos >= offset && step > 1) { |
| 237 | pos -= offset; | 238 | pos -= offset; |
| 238 | pos++; | 239 | pos++; |
| 239 | } | 240 | } |
| 240 | if (pos >= offset) | ||
| 241 | return AVERROR_INVALIDDATA; | ||
| 242 | } | 241 | } |
| 243 | left -= 2; | 242 | left -= 2; |
| 244 | } else { /* copy */ | 243 | } else { /* copy */ |
| 245 | for (j = 0; j < code + 1; j++) { | 244 | for (j = 0; j < code + 1; j++) { |
| 246 | out[pos] = bytestream2_get_byte(gbc); | 245 | if (pos < offset) |
| 246 | out[pos] = bytestream2_get_byte(gbc); | ||
| 247 | pos += step; | 247 | pos += step; |
| 248 | if (pos >= offset) { | 248 | if (pos >= offset && step > 1) { |
| 249 | pos -= offset; | 249 | pos -= offset; |
| 250 | pos++; | 250 | pos++; |
| 251 | } | 251 | } |
| 252 | if (pos >= offset) | ||
| 253 | return AVERROR_INVALIDDATA; | ||
| 254 | } | 252 | } |
| 255 | left -= 2 + code; | 253 | left -= 2 + code; |
| 256 | } | 254 | } |