Mercurial > libavcodec.hg
comparison 8bps.c @ 2788:1bf080e490db libavcodec
fix segfault (bug #1165640)
| author | michael |
|---|---|
| date | Mon, 11 Jul 2005 22:56:23 +0000 |
| parents | f67b63ed036d |
| children | ef2149182f1c |
comparison
equal
deleted
inserted
replaced
| 2787:af90d5dc83f0 | 2788:1bf080e490db |
|---|---|
| 98 pixptr = c->pic.data[0] + row * c->pic.linesize[0] + planemap[p]; | 98 pixptr = c->pic.data[0] + row * c->pic.linesize[0] + planemap[p]; |
| 99 pixptr_end = pixptr + c->pic.linesize[0]; | 99 pixptr_end = pixptr + c->pic.linesize[0]; |
| 100 dlen = be2me_16(*(unsigned short *)(lp+row*2)); | 100 dlen = be2me_16(*(unsigned short *)(lp+row*2)); |
| 101 /* Decode a row of this plane */ | 101 /* Decode a row of this plane */ |
| 102 while(dlen > 0) { | 102 while(dlen > 0) { |
| 103 if(dp + 1 >= buf+buf_size) return -1; | |
| 103 if ((count = *dp++) <= 127) { | 104 if ((count = *dp++) <= 127) { |
| 104 count++; | 105 count++; |
| 105 dlen -= count + 1; | 106 dlen -= count + 1; |
| 106 if (pixptr + count * px_inc > pixptr_end) | 107 if (pixptr + count * px_inc > pixptr_end) |
| 107 break; | 108 break; |
| 109 if(dp + count > buf+buf_size) return -1; | |
| 108 while(count--) { | 110 while(count--) { |
| 109 *pixptr = *dp++; | 111 *pixptr = *dp++; |
| 110 pixptr += px_inc; | 112 pixptr += px_inc; |
| 111 } | 113 } |
| 112 } else { | 114 } else { |
