bmv: fix apparent sign error in the frame_off check
authorMichael Niedermayer <michaelni@gmx.at>
Sat, 2 Jun 2012 02:06:16 +0000 (04:06 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 9 Jun 2012 18:49:18 +0000 (20:49 +0200)
Fixes part of Ticket1373

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit debbcfae6010f027a0334d70d0dbb7ddd912ad5a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/bmv.c

index 9740b11..35923a2 100644 (file)
@@ -143,7 +143,7 @@ static int decode_bmv_frame(const uint8_t *source, int src_len, uint8_t *frame,
         switch (mode) {
         case 1:
             if (forward) {
-                if (dst - frame + SCREEN_WIDE < frame_off ||
+                if (dst - frame + SCREEN_WIDE < -frame_off ||
                         frame_end - dst < frame_off + len)
                     return -1;
                 for (i = 0; i < len; i++)
@@ -151,7 +151,7 @@ static int decode_bmv_frame(const uint8_t *source, int src_len, uint8_t *frame,
                 dst += len;
             } else {
                 dst -= len;
-                if (dst - frame + SCREEN_WIDE < frame_off ||
+                if (dst - frame + SCREEN_WIDE < -frame_off ||
                         frame_end - dst < frame_off + len)
                     return -1;
                 for (i = len - 1; i >= 0; i--)