Fix a crash when decoding tiff by moving check

[ffmpeg] / libavcodec / bmp.c

diff --git a/libavcodec/bmp.c b/libavcodec/bmp.c
index 8a73fb7ab5a776e1f7e4a671b5d6925289fc5765..270452fe6657236b2c92e2fc2007401102280d77 100644 (file)
--- a/libavcodec/bmp.c
+++ b/libavcodec/bmp.c
@@ -253,7 +253,15 @@ static int bmp_decode_frame(AVCodecContext *avctx,
         buf = buf0 + hsize;
     }
     if(comp == BMP_RLE4 || comp == BMP_RLE8){
+        if(height < 0){
+            p->data[0] += p->linesize[0] * (avctx->height - 1);
+            p->linesize[0] = -p->linesize[0];
+        }
         ff_msrle_decode(avctx, (AVPicture*)p, depth, buf, dsize);
+        if(height < 0){
+            p->data[0] += p->linesize[0] * (avctx->height - 1);
+            p->linesize[0] = -p->linesize[0];
+        }
     }else{
         switch(depth){
         case 1:
@@ -282,7 +290,7 @@ static int bmp_decode_frame(AVCodecContext *avctx,
                 uint16_t *dst = (uint16_t *) ptr;
 
                 for(j = 0; j < avctx->width; j++)
-                    *dst++ = le2me_16(*src++);
+                    *dst++ = av_le2ne16(*src++);
 
                 buf += n;
                 ptr += linesize;
@@ -329,7 +337,7 @@ static av_cold int bmp_decode_end(AVCodecContext *avctx)
 
 AVCodec bmp_decoder = {
     "bmp",
-    CODEC_TYPE_VIDEO,
+    AVMEDIA_TYPE_VIDEO,
     CODEC_ID_BMP,
     sizeof(BMPContext),
     bmp_decode_init,
@@ -337,5 +345,6 @@ AVCodec bmp_decoder = {
     bmp_decode_end,
     bmp_decode_frame,
     CODEC_CAP_DR1,
+    .max_lowres = 5,
     .long_name = NULL_IF_CONFIG_SMALL("BMP image"),
 };