Fix off-by-one error in MS RLE decoder which may result into writing past
authorKostya Shishkov <kostya.shishkov@gmail.com>
Sat, 16 May 2009 06:39:08 +0000 (06:39 +0000)
committerKostya Shishkov <kostya.shishkov@gmail.com>
Sat, 16 May 2009 06:39:08 +0000 (06:39 +0000)
picture buffer.

Originally committed as revision 18852 to svn://svn.ffmpeg.org/ffmpeg/trunk

libavcodec/msrledec.c

index 40fec31..1401ee3 100644 (file)
@@ -134,7 +134,7 @@ static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic, int de
 {
     uint8_t *output, *output_end;
     const uint8_t* src = data;
 {
     uint8_t *output, *output_end;
     const uint8_t* src = data;
-    int p1, p2, line=avctx->height, pos=0, i;
+    int p1, p2, line=avctx->height - 1, pos=0, i;
     uint16_t av_uninit(pix16);
     uint32_t av_uninit(pix32);
 
     uint16_t av_uninit(pix16);
     uint32_t av_uninit(pix32);