comparison rle.c @ 7455:0e9e36d55e5e libavcodec

Fix a potential out of array writing. Patch by Mathieu Malaterre mathieu malaterre gmail com

7454:bb5e8cae1d71

            memcpy(out, ptr, bpp);
            out += bpp;
        } else {
            /* fall back on uncompressed */
            count = count_pixels(ptr, w-x, bpp, 0);
            *out++ = (count ^ xor_raw) + add_raw;

            if(out + bpp*count > outbuf + out_size) return -1;
            memcpy(out, ptr, bpp * count);
            out += bpp * count;
        }

        ptr += count * bpp;

7455:0e9e36d55e5e

            memcpy(out, ptr, bpp);
            out += bpp;
        } else {
            /* fall back on uncompressed */
            count = count_pixels(ptr, w-x, bpp, 0);
            if(out + bpp*count >= outbuf + out_size) return -1;
            *out++ = (count ^ xor_raw) + add_raw;

            memcpy(out, ptr, bpp * count);
            out += bpp * count;
        }

        ptr += count * bpp;