Mercurial > libavcodec.hg
comparison 8bps.c @ 2788:1bf080e490db libavcodec
fix segfault (bug #1165640)
author | michael |
---|---|
date | Mon, 11 Jul 2005 22:56:23 +0000 |
parents | f67b63ed036d |
children | ef2149182f1c |
comparison
equal
deleted
inserted
replaced
2787:af90d5dc83f0 | 2788:1bf080e490db |
---|---|
98 pixptr = c->pic.data[0] + row * c->pic.linesize[0] + planemap[p]; | 98 pixptr = c->pic.data[0] + row * c->pic.linesize[0] + planemap[p]; |
99 pixptr_end = pixptr + c->pic.linesize[0]; | 99 pixptr_end = pixptr + c->pic.linesize[0]; |
100 dlen = be2me_16(*(unsigned short *)(lp+row*2)); | 100 dlen = be2me_16(*(unsigned short *)(lp+row*2)); |
101 /* Decode a row of this plane */ | 101 /* Decode a row of this plane */ |
102 while(dlen > 0) { | 102 while(dlen > 0) { |
103 if(dp + 1 >= buf+buf_size) return -1; | |
103 if ((count = *dp++) <= 127) { | 104 if ((count = *dp++) <= 127) { |
104 count++; | 105 count++; |
105 dlen -= count + 1; | 106 dlen -= count + 1; |
106 if (pixptr + count * px_inc > pixptr_end) | 107 if (pixptr + count * px_inc > pixptr_end) |
107 break; | 108 break; |
109 if(dp + count > buf+buf_size) return -1; | |
108 while(count--) { | 110 while(count--) { |
109 *pixptr = *dp++; | 111 *pixptr = *dp++; |
110 pixptr += px_inc; | 112 pixptr += px_inc; |
111 } | 113 } |
112 } else { | 114 } else { |