summaryrefslogtreecommitdiff
path: root/libavcodec
diff options
context:
space:
mode:
authorPeter Ross <pross@xvid.org>2011-11-27 12:07:47 +1100
committerMichael Niedermayer <michaelni@gmx.at>2011-11-27 03:11:08 +0100
commitb4886795108e319a5b3a88370e90207d9c15a01e (patch)
treed0ad0020576814573b2845d4616e3fbfa6e361fd /libavcodec
parent801393bc96df538422dbc9580daea3335cd22f8c (diff)
iff: fix invalid reads (ticket 689)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
-rw-r--r--libavcodec/iff.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/iff.c b/libavcodec/iff.c
index c4c614ed4e..30a3f6f766 100644
--- a/libavcodec/iff.c
+++ b/libavcodec/iff.c
@@ -464,7 +464,7 @@ static int decode_frame_ilbm(AVCodecContext *avctx,
} else if (s->ham) { // HAM to PIX_FMT_BGR32
for (y = 0; y < avctx->height; y++) {
uint8_t *row = &s->frame.data[0][ y*s->frame.linesize[0] ];
- memset(s->ham_buf, 0, avctx->width);
+ memset(s->ham_buf, 0, s->planesize * 8);
for (plane = 0; plane < s->bpp && buf < buf_end; plane++) {
decodeplane8(s->ham_buf, buf, FFMIN(s->planesize, buf_end - buf), plane);
buf += s->planesize;
@@ -540,7 +540,7 @@ static int decode_frame_byterun1(AVCodecContext *avctx,
} else if (s->ham) { // HAM to PIX_FMT_BGR32
for (y = 0; y < avctx->height ; y++) {
uint8_t *row = &s->frame.data[0][y*s->frame.linesize[0]];
- memset(s->ham_buf, 0, avctx->width);
+ memset(s->ham_buf, 0, s->planesize * 8);
for (plane = 0; plane < s->bpp; plane++) {
buf += decode_byterun(s->planebuf, s->planesize, buf, buf_end);
decodeplane8(s->ham_buf, s->planebuf, s->planesize, plane);