← Back to branch summary

~ubuntu-branches/ubuntu/utopic/ffmpeg-debian/utopic

« back to all changes in this revision

Viewing changes to libavcodec/msrledec.c

  • Committer: Bazaar Package Importer
  • Author(s): Reinhard Tartler
  • Date: 2009-01-20 09:20:53 UTC
  • mfrom: (1.1.3 upstream)
  • Revision ID: james.westby@ubuntu.com-20090120092053-izz63p40hc98qfgp
Tags: 3:0.svn20090119-1ubuntu1
https://launchpad.net/bugs/318501
https://launchpad.net/bugs/253767
* merge from debian. LP: #318501
* new version fixes CVE-2008-3230, LP: #253767

Show diffs side-by-side

added added

removed removed

Lines of Context:
libavcodec/msrledec.c
26
26
 *   http://www.multimedia.cx/msrle.txt
27
27
 */
28
28
 
 
29
#include "libavutil/intreadwrite.h"
29
30
#include "avcodec.h"
30
31
 
31
32
#define FETCH_NEXT_STREAM_BYTE() \
145
146
            p2 = *src++;
146
147
            if(p2 == 0) { //End-of-line
147
148
                output = pic->data[0] + (--line) * pic->linesize[0];
148
 
                if (line < 0)
 
149
                if (line < 0){
 
150
                    av_log(avctx, AV_LOG_ERROR, "Next line is beyond picture bounds\n");
149
151
                    return -1;
 
152
                }
150
153
                pos = 0;
151
154
                continue;
152
155
            } else if(p2 == 1) { //End-of-picture
155
158
                p1 = *src++;
156
159
                p2 = *src++;
157
160
                line -= p2;
158
 
                if (line < 0)
 
161
                if (line < 0){
 
162
                    av_log(avctx, AV_LOG_ERROR, "Skip beyond picture bounds\n");
159
163
                    return -1;
 
164
                }
160
165
                pos += p1;
161
166
                output = pic->data[0] + line * pic->linesize[0] + pos * (depth >> 3);
162
167
                continue;
191
196
            }
192
197
            pos += p2;
193
198
        } else { //Run of pixels
194
 
            int pix[4]; //original pixel
 
199
            uint8_t pix[3]; //original pixel
195
200
            switch(depth){
196
201
            case  8: pix[0] = *src++;
197
202
                     break;
198
203
            case 16: pix16 = AV_RL16(src);
199
204
                     src += 2;
200
 
                     *(uint16_t*)pix = pix16;
201
205
                     break;
202
206
            case 24: pix[0] = *src++;
203
207
                     pix[1] = *src++;
205
209
                     break;
206
210
            case 32: pix32 = AV_RL32(src);
207
211
                     src += 4;
208
 
                     *(uint32_t*)pix = pix32;
209
212
                     break;
210
213
            }
211
214
            if (output + p1 * (depth >> 3) > output_end)