diff options
| author | Reinhard Tartler <siretart@tauware.de> | 2010-02-26 10:56:46 +0000 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2010-02-26 10:56:46 +0000 |
| commit | 9d9f1ecfaa1558cb89d9dd5f0efa1415ae11030e (patch) | |
| tree | de9c934e9a637503ca2e72427448b002d870b0ee | |
| parent | 53b90bb25edfd608cb6ae9201ca42052bb54b62f (diff) | |
Make sure we dont read over the end.
Fixes issue1237.
backport r19322 by michael
Originally committed as revision 22074 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
| -rw-r--r-- | libavcodec/huffyuv.c | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/libavcodec/huffyuv.c b/libavcodec/huffyuv.c index 51acf0570d..dfa06d53a6 100644 --- a/libavcodec/huffyuv.c +++ b/libavcodec/huffyuv.c @@ -728,10 +728,17 @@ static void decode_422_bitstream(HYuvContext *s, int count){ count/=2; + if(count >= (s->gb.size_in_bits - get_bits_count(&s->gb))/(31*4)){ + for(i=0; i<count && get_bits_count(&s->gb) < s->gb.size_in_bits; i++){ + READ_2PIX(s->temp[0][2*i ], s->temp[1][i], 1); + READ_2PIX(s->temp[0][2*i+1], s->temp[2][i], 2); + } + }else{ for(i=0; i<count; i++){ READ_2PIX(s->temp[0][2*i ], s->temp[1][i], 1); READ_2PIX(s->temp[0][2*i+1], s->temp[2][i], 2); } + } } static void decode_gray_bitstream(HYuvContext *s, int count){ @@ -739,9 +746,15 @@ static void decode_gray_bitstream(HYuvContext *s, int count){ count/=2; + if(count >= (s->gb.size_in_bits - get_bits_count(&s->gb))/(31*2)){ + for(i=0; i<count && get_bits_count(&s->gb) < s->gb.size_in_bits; i++){ + READ_2PIX(s->temp[0][2*i ], s->temp[0][2*i+1], 0); + } + }else{ for(i=0; i<count; i++){ READ_2PIX(s->temp[0][2*i ], s->temp[0][2*i+1], 0); } + } } #if CONFIG_HUFFYUV_ENCODER || CONFIG_FFVHUFF_ENCODER |