From 37458d7e1bd30316ebd61d10a6a1b4ccad532597 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michaelni@gmx.at>
Date: Wed, 1 Jul 2009 20:30:37 +0000
Subject: Make sure we dont read over the end. Fixes issue1237.

Originally committed as revision 19322 to svn://svn.ffmpeg.org/ffmpeg/trunk
---
 libavcodec/huffyuv.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

(limited to 'libavcodec/huffyuv.c')

diff --git a/libavcodec/huffyuv.c b/libavcodec/huffyuv.c
index 092a1096b6..aca8e3e9d9 100644
--- a/libavcodec/huffyuv.c
+++ b/libavcodec/huffyuv.c
@@ -729,10 +729,17 @@ static void decode_422_bitstream(HYuvContext *s, int count){
 
     count/=2;
 
+    if(count >= (s->gb.size_in_bits - get_bits_count(&s->gb))/(31*4)){
+        for(i=0; i<count && get_bits_count(&s->gb) < s->gb.size_in_bits; i++){
+            READ_2PIX(s->temp[0][2*i  ], s->temp[1][i], 1);
+            READ_2PIX(s->temp[0][2*i+1], s->temp[2][i], 2);
+        }
+    }else{
     for(i=0; i<count; i++){
         READ_2PIX(s->temp[0][2*i  ], s->temp[1][i], 1);
         READ_2PIX(s->temp[0][2*i+1], s->temp[2][i], 2);
     }
+    }
 }
 
 static void decode_gray_bitstream(HYuvContext *s, int count){
@@ -740,9 +747,15 @@ static void decode_gray_bitstream(HYuvContext *s, int count){
 
     count/=2;
 
+    if(count >= (s->gb.size_in_bits - get_bits_count(&s->gb))/(31*2)){
+        for(i=0; i<count && get_bits_count(&s->gb) < s->gb.size_in_bits; i++){
+            READ_2PIX(s->temp[0][2*i  ], s->temp[0][2*i+1], 0);
+        }
+    }else{
     for(i=0; i<count; i++){
         READ_2PIX(s->temp[0][2*i  ], s->temp[0][2*i+1], 0);
     }
+    }
 }
 
 #if CONFIG_HUFFYUV_ENCODER || CONFIG_FFVHUFF_ENCODER
-- 
cgit v1.2.3