From 98b7a50a2100e3dad96821d2c0adac369652707d Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 24 Dec 2012 04:35:12 +0100 Subject: tiffdec: Fix runend handling Fixes Ticket1999 Signed-off-by: Michael Niedermayer --- libavcodec/faxcompr.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'libavcodec') diff --git a/libavcodec/faxcompr.c b/libavcodec/faxcompr.c index e7f9d00a11..3e51a3e793 100644 --- a/libavcodec/faxcompr.c +++ b/libavcodec/faxcompr.c @@ -163,8 +163,6 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb, int run_off = *ref++; unsigned int offs=0, run= 0; - runend--; // for the last written 0 - while(offs < width){ int cmode = get_vlc2(gb, ccitt_group3_2d_vlc.table, 9, 1); if(cmode == -1){ @@ -234,7 +232,13 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb, } } *runs++ = saved_run; - *runs++ = 0; + if (saved_run) { + if(runs >= runend){ + av_log(avctx, AV_LOG_ERROR, "Run overrun\n"); + return -1; + } + *runs++ = 0; + } return 0; } -- cgit v1.2.3