mpegvideo_parser: fix buffer access beyond end

[ffmpeg] / libavcodec / xxan.c

diff --git a/libavcodec/xxan.c b/libavcodec/xxan.c
index 2c33f07a71b1d8ff381fa4a6b310854cc0964672..ed1821772f53a142b1c3bd3df24c6ed66bc9eb6f 100644 (file)
--- a/libavcodec/xxan.c
+++ b/libavcodec/xxan.c
@@ -276,7 +276,8 @@ static int xan_decode_frame_type0(AVCodecContext *avctx)
         ybuf[j+1] = cur << 1;
         last = cur;
     }
-    ybuf[j]  = last << 1;
+    if(j < avctx->width)
+        ybuf[j]  = last << 1;
     prev_buf = ybuf;
     ybuf += avctx->width;
 
@@ -350,7 +351,8 @@ static int xan_decode_frame_type1(AVCodecContext *avctx)
             ybuf[j+1] = cur;
             last = cur;
         }
-        ybuf[j] = last;
+        if(j < avctx->width)
+            ybuf[j] = last;
         ybuf += avctx->width;
     }
 
@@ -367,7 +369,7 @@ static int xan_decode_frame_type1(AVCodecContext *avctx)
 }
 
 static int xan_decode_frame(AVCodecContext *avctx,
-                            void *data, int *data_size,
+                            void *data, int *got_frame,
                             AVPacket *avpkt)
 {
     XanContext *s = avctx->priv_data;
@@ -399,7 +401,7 @@ static int xan_decode_frame(AVCodecContext *avctx,
     if (ret)
         return ret;
 
-    *data_size = sizeof(AVFrame);
+    *got_frame = 1;
     *(AVFrame*)data = s->pic;
 
     return avpkt->size;