proresdec: Properly make sure an index doesn't run past the limit
authorMartin Storsjö <martin@martin.st>
Thu, 12 Sep 2013 09:10:18 +0000 (12:10 +0300)
committerMartin Storsjö <martin@martin.st>
Mon, 16 Sep 2013 08:04:52 +0000 (11:04 +0300)
If idx equaled num_coeffs - 1 on entry to the loop, the previous
check failed to break out of the loop.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
libavcodec/proresdec.c

index c13b769..c3b480f 100644 (file)
@@ -496,7 +496,7 @@ static void unpack_alpha(GetBitContext *gb, uint16_t *dst, int num_coeffs,
                 dst[idx++] = alpha_val >> 6;
             else
                 dst[idx++] = (alpha_val << 2) | (alpha_val >> 6);
                 dst[idx++] = alpha_val >> 6;
             else
                 dst[idx++] = (alpha_val << 2) | (alpha_val >> 6);
-            if (idx == num_coeffs - 1)
+            if (idx >= num_coeffs - 1)
                 break;
         } while (get_bits1(gb));
         val = get_bits(gb, 4);
                 break;
         } while (get_bits1(gb));
         val = get_bits(gb, 4);