diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-03-30 03:01:41 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-03-30 03:09:08 +0200 |
| commit | 445fdc014017a236fa7aa2645ffad7e8d0b45bee (patch) | |
| tree | 1bd6be8b1dbf95535926c0e1348c63027ecb4339 /libavcodec/dfa.c | |
| parent | 55ce3c67bb25cd44889f2143ce9fd7dac3ab4a9d (diff) | |
| parent | 52fd16a264d1eb14b1a84b7b38041da1756fb216 (diff) | |
Merge remote-tracking branch 'newdev/master'
* newdev/master:
ac3enc: move compute_mantissa_size() to ac3dsp
ac3enc: move mant*_cnt and qmant*_ptr out of AC3EncodeContext
Remove support for stripping executables
ac3enc: NEON optimised float_to_fixed24
ac3: move ff_ac3_bit_alloc_calc_bap to ac3dsp
dfa: protect pointer range checks against overflows.
Duplicate: mimic: implement multithreading.
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/dfa.c')
| -rw-r--r-- | libavcodec/dfa.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libavcodec/dfa.c b/libavcodec/dfa.c index 6736234911..6337a5d4ca 100644 --- a/libavcodec/dfa.c +++ b/libavcodec/dfa.c @@ -81,7 +81,7 @@ static int decode_tsw1(uint8_t *frame, int width, int height, v = bytestream_get_le16(&src); offset = (v & 0x1FFF) << 1; count = ((v >> 13) + 2) << 1; - if (frame - offset < frame_start || frame_end - frame < count) + if (frame - frame_start < offset || frame_end - frame < count) return -1; av_memcpy_backptr(frame, offset, count); frame += count; @@ -117,7 +117,7 @@ static int decode_dsw1(uint8_t *frame, int width, int height, v = bytestream_get_le16(&src); offset = (v & 0x1FFF) << 1; count = ((v >> 13) + 2) << 1; - if (frame - offset < frame_start || frame_end - frame < count) + if (frame - frame_start < offset || frame_end - frame < count) return -1; // can't use av_memcpy_backptr() since it can overwrite following pixels for (v = 0; v < count; v++) @@ -157,7 +157,7 @@ static int decode_dds1(uint8_t *frame, int width, int height, v = bytestream_get_le16(&src); offset = (v & 0x1FFF) << 2; count = ((v >> 13) + 2) << 1; - if (frame - offset < frame_start || frame_end - frame < count*2 + width) + if (frame - frame_start < offset || frame_end - frame < count*2 + width) return -1; for (i = 0; i < count; i++) { frame[0] = frame[1] = |