Mercurial > libavcodec.hg

comparison msrledec.c @ 9657:8a65ae8929fb libavcodec

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Fix off-by-one error in MS RLE decoder which may result into writing past picture buffer.
author kostya
date Sat, 16 May 2009 06:39:08 +0000
parents 096ab16191a9
children c1ed557cd3b8
comparison
equal deleted inserted replaced
9656:03361db4df10 9657:8a65ae8929fb
132 static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic, int depth, 132 static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic, int depth,
133 const uint8_t *data, int srcsize) 133 const uint8_t *data, int srcsize)
134 { 134 {
135 uint8_t *output, *output_end; 135 uint8_t *output, *output_end;
136 const uint8_t* src = data; 136 const uint8_t* src = data;
137 int p1, p2, line=avctx->height, pos=0, i; 137 int p1, p2, line=avctx->height - 1, pos=0, i;
138 uint16_t av_uninit(pix16); 138 uint16_t av_uninit(pix16);
139 uint32_t av_uninit(pix32); 139 uint32_t av_uninit(pix32);
140 140
141 output = pic->data[0] + (avctx->height - 1) * pic->linesize[0]; 141 output = pic->data[0] + (avctx->height - 1) * pic->linesize[0];
142 output_end = pic->data[0] + (avctx->height) * pic->linesize[0]; 142 output_end = pic->data[0] + (avctx->height) * pic->linesize[0];