Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Laurent Aimar authored on 2011/10/01 07:44:59... | ... |
@@ -56,7 +56,7 @@ static void cmv_decode_intra(CmvContext * s, const uint8_t *buf, const uint8_t * |
56 | 56 |
unsigned char *dst = s->frame.data[0]; |
57 | 57 |
int i; |
58 | 58 |
|
59 |
- for (i=0; i < s->avctx->height && buf+s->avctx->width<=buf_end; i++) { |
|
59 |
+ for (i=0; i < s->avctx->height && buf_end - buf >= s->avctx->width; i++) { |
|
60 | 60 |
memcpy(dst, buf, s->avctx->width); |
61 | 61 |
dst += s->frame.linesize[0]; |
62 | 62 |
buf += s->avctx->width; |
... | ... |
@@ -88,7 +88,7 @@ static void cmv_decode_inter(CmvContext * s, const uint8_t *buf, const uint8_t * |
88 | 88 |
|
89 | 89 |
i = 0; |
90 | 90 |
for(y=0; y<s->avctx->height/4; y++) |
91 |
- for(x=0; x<s->avctx->width/4 && buf+i<buf_end; x++) { |
|
91 |
+ for(x=0; x<s->avctx->width/4 && buf_end - buf > i; x++) { |
|
92 | 92 |
if (buf[i]==0xFF) { |
93 | 93 |
unsigned char *dst = s->frame.data[0] + (y*4)*s->frame.linesize[0] + x*4; |
94 | 94 |
if (raw+16<buf_end && *raw==0xFF) { /* intra */ |
... | ... |
@@ -122,7 +122,7 @@ static void cmv_process_header(CmvContext *s, const uint8_t *buf, const uint8_t |
122 | 122 |
{ |
123 | 123 |
int pal_start, pal_count, i; |
124 | 124 |
|
125 |
- if(buf+16>=buf_end) { |
|
125 |
+ if(buf_end - buf < 16) { |
|
126 | 126 |
av_log(s->avctx, AV_LOG_WARNING, "truncated header\n"); |
127 | 127 |
return; |
128 | 128 |
} |
... | ... |
@@ -139,7 +139,7 @@ static void cmv_process_header(CmvContext *s, const uint8_t *buf, const uint8_t |
139 | 139 |
pal_count = AV_RL16(&buf[14]); |
140 | 140 |
|
141 | 141 |
buf += 16; |
142 |
- for (i=pal_start; i<pal_start+pal_count && i<AVPALETTE_COUNT && buf+2<buf_end; i++) { |
|
142 |
+ for (i=pal_start; i<pal_start+pal_count && i<AVPALETTE_COUNT && buf_end - buf >= 3; i++) { |
|
143 | 143 |
s->palette[i] = AV_RB24(buf); |
144 | 144 |
buf += 3; |
145 | 145 |
} |