jpeglsdec: Prevent out of array write.
authorMichael Niedermayer <michaelni@gmx.at>
Mon, 13 Feb 2012 22:50:35 +0000 (23:50 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Fri, 16 Mar 2012 15:46:30 +0000 (16:46 +0100)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 00ab9cdae1a96dfea33cd505076a83823f390aa4)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/jpeglsdec.c

index 0139c88..74714e0 100644 (file)
@@ -198,6 +198,9 @@ static inline void ls_decode_line(JLSState *state, MJpegDecodeContext *s, void *
             r = ff_log2_run[state->run_index[comp]];
             if(r)
                 r = get_bits_long(&s->gb, r);
+            if(x + r * stride > w) {
+                r = (w - x) / stride;
+            }
             for(i = 0; i < r; i++) {
                 W(dst, x, Ra);
                 x += stride;