X-Git-Url: http://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff_plain/94ee6c100dea2f66088f92cae4e16676197e0151..a8798c7eb934055d6aae51c6c7627559c33317d8:/libavcodec/msrledec.c

diff --git a/libavcodec/msrledec.c b/libavcodec/msrledec.c
index 2f27d20..9854d82 100644
--- a/libavcodec/msrledec.c
+++ b/libavcodec/msrledec.c
@@ -2,20 +2,20 @@
  * Microsoft RLE decoder
  * Copyright (C) 2008 Konstantin Shishkov
  *
- * This file is part of FFmpeg.
+ * This file is part of Libav.
  *
- * FFmpeg is free software; you can redistribute it and/or
+ * Libav is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
  *
- * FFmpeg is distributed in the hope that it will be useful,
+ * Libav is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public
- * License along with FFmpeg; if not, write to the Free Software
+ * License along with Libav; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
@@ -45,7 +45,7 @@ static int msrle_decode_pal4(AVCodecContext *avctx, AVPicture *pic,
     unsigned char rle_code;
     unsigned char extra_byte, odd_pixel;
     unsigned char stream_byte;
-    int pixel_ptr = 0;
+    unsigned int pixel_ptr = 0;
     int row_dec = pic->linesize[0];
     int row_ptr = (avctx->height - 1) * row_dec;
     int frame_size = row_dec * avctx->height;
@@ -75,8 +75,7 @@ static int msrle_decode_pal4(AVCodecContext *avctx, AVPicture *pic,
                 odd_pixel =  stream_byte & 1;
                 rle_code = (stream_byte + 1) / 2;
                 extra_byte = rle_code & 0x01;
-                if ((row_ptr + pixel_ptr + stream_byte > frame_size) ||
-                    (row_ptr < 0)) {
+                if (row_ptr + pixel_ptr + stream_byte > frame_size) {
                     av_log(avctx, AV_LOG_ERROR, " MS RLE: frame ptr just went out of bounds (1)\n");
                     return -1;
                 }
@@ -101,8 +100,7 @@ static int msrle_decode_pal4(AVCodecContext *avctx, AVPicture *pic,
             }
         } else {
             // decode a run of data
-            if ((row_ptr + pixel_ptr + stream_byte > frame_size) ||
-                (row_ptr < 0)) {
+            if (row_ptr + pixel_ptr + stream_byte > frame_size) {
                 av_log(avctx, AV_LOG_ERROR, " MS RLE: frame ptr just went out of bounds (1)\n");
                 return -1;
             }
@@ -136,11 +134,12 @@ static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic, int de
     uint8_t *output, *output_end;
     const uint8_t* src = data;
     int p1, p2, line=avctx->height - 1, pos=0, i;
-    uint16_t av_uninit(pix16);
-    uint32_t av_uninit(pix32);
+    uint16_t pix16;
+    uint32_t pix32;
+    unsigned int width= FFABS(pic->linesize[0]) / (depth >> 3);
 
-    output = pic->data[0] + (avctx->height - 1) * pic->linesize[0];
-    output_end = pic->data[0] + (avctx->height) * pic->linesize[0];
+    output     = pic->data[0] + (avctx->height - 1) * pic->linesize[0];
+    output_end = pic->data[0] +  avctx->height      * pic->linesize[0];
     while(src < data + srcsize) {
         p1 = *src++;
         if(p1 == 0) { //Escape code
@@ -159,11 +158,11 @@ static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic, int de
                 p1 = *src++;
                 p2 = *src++;
                 line -= p2;
-                if (line < 0){
+                pos += p1;
+                if (line < 0 || pos >= width){
                     av_log(avctx, AV_LOG_ERROR, "Skip beyond picture bounds\n");
                     return -1;
                 }
-                pos += p1;
                 output = pic->data[0] + line * pic->linesize[0] + pos * (depth >> 3);
                 continue;
             }
@@ -257,4 +256,3 @@ int ff_msrle_decode(AVCodecContext *avctx, AVPicture *pic, int depth,
         return -1;
     }
 }
-