MrBesen/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

mmvideo: Make sure the rle does not write over the frame boundaries

Browse Source 
Bug-Id: 887
CC: libav-stable@libav.org
This commit is contained in:
Luca Barbato 2015-09-10 14:46:05 +02:00
parent 41ed749fe9
commit 9b5a4a9cce
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/mmvideo.c
View File

@ -99,7 +99,8 @@ static int mm_decode_intra(MmContext * s, int half_horiz, int half_vert)
while (bytestream2_get_bytes_left(&s->gb) > 0) {
int run_length, color;
if (y >= s->avctx->height)
// writes one more line when half_vert is true
if (y >= s->avctx->height + !!half_vert)
return 0;
color = bytestream2_get_byte(&s->gb);
@ -113,6 +114,9 @@ static int mm_decode_intra(MmContext * s, int half_horiz, int half_vert)
if (half_horiz)
run_length *=2;
if (s->avctx->width - x < run_length)
return AVERROR_INVALIDDATA;
if (color) {
memset(s->frame->data[0] + y*s->frame->linesize[0] + x, color, run_length);
if (half_vert)