From 9bd6375d5f16842306dcecde637ffe605acda26b Mon Sep 17 00:00:00 2001 From: Anton Khirnov Date: Tue, 29 Jan 2013 12:24:09 +0100 Subject: msrledec: check bounds before constructing a possibly invalid pointer, CC:libav-stable@libav.org --- libavcodec/msrledec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'libavcodec/msrledec.c') diff --git a/libavcodec/msrledec.c b/libavcodec/msrledec.c index fad94151c9..af2a2478b1 100644 --- a/libavcodec/msrledec.c +++ b/libavcodec/msrledec.c @@ -144,8 +144,7 @@ static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic, if(p1 == 0) { //Escape code p2 = bytestream2_get_byte(gb); if(p2 == 0) { //End-of-line - output = pic->data[0] + (--line) * pic->linesize[0]; - if (line < 0) { + if (--line < 0) { if (bytestream2_get_be16(gb) == 1) { // end-of-picture return 0; } else { @@ -155,6 +154,7 @@ static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic, return AVERROR_INVALIDDATA; } } + output = pic->data[0] + line * pic->linesize[0]; pos = 0; continue; } else if(p2 == 1) { //End-of-picture -- cgit v1.2.3