From e8f917d6fd9f42fa4f36fd6dd8a21c1e31cd1c26 Mon Sep 17 00:00:00 2001
From: Michel Bardiaux <mbardiaux@peaktime.be>
Date: Wed, 31 Jan 2007 11:19:48 +0000
Subject: Fix memcpy out-of-bounds. patch by Michel Bardiaux, mbardiaux
 mediaxim be

Originally committed as revision 7780 to svn://svn.ffmpeg.org/ffmpeg/trunk
---
 libavcodec/bmp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'libavcodec/bmp.c')

diff --git a/libavcodec/bmp.c b/libavcodec/bmp.c
index 20cca16ac7..30eee65185 100644
--- a/libavcodec/bmp.c
+++ b/libavcodec/bmp.c
@@ -187,7 +187,7 @@ static int bmp_decode_frame(AVCodecContext *avctx,
     switch(depth){
     case 24:
         for(i = 0; i < avctx->height; i++){
-            memcpy(ptr, buf, n);
+            memcpy(ptr, buf, avctx->width*(depth>>3));
             buf += n;
             ptr += linesize;
         }
-- 
cgit v1.2.3