X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fmsrledec.c;h=9854d82fb4ef2e4a6ab262cd7bc28ebf99b79e65;hb=a8798c7eb934055d6aae51c6c7627559c33317d8;hp=407022d34d74ea83a83e9e934793930553aabbd4;hpb=ccd17ea13c26d86b0697868f43e848a5a15ab36e;p=ffmpeg

diff --git a/libavcodec/msrledec.c b/libavcodec/msrledec.c
index 407022d34d7..9854d82fb4e 100644
--- a/libavcodec/msrledec.c
+++ b/libavcodec/msrledec.c
@@ -2,25 +2,25 @@
  * Microsoft RLE decoder
  * Copyright (C) 2008 Konstantin Shishkov
  *
- * This file is part of FFmpeg.
+ * This file is part of Libav.
  *
- * FFmpeg is free software; you can redistribute it and/or
+ * Libav is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
  *
- * FFmpeg is distributed in the hope that it will be useful,
+ * Libav is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public
- * License along with FFmpeg; if not, write to the Free Software
+ * License along with Libav; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
 /**
- * @file libavcodec/msrledec.c
+ * @file
  * MS RLE decoder based on decoder by Mike Melanson and my own for TSCC
  * For more information about the MS RLE format, visit:
  *   http://www.multimedia.cx/msrle.txt
@@ -45,7 +45,7 @@ static int msrle_decode_pal4(AVCodecContext *avctx, AVPicture *pic,
     unsigned char rle_code;
     unsigned char extra_byte, odd_pixel;
     unsigned char stream_byte;
-    int pixel_ptr = 0;
+    unsigned int pixel_ptr = 0;
     int row_dec = pic->linesize[0];
     int row_ptr = (avctx->height - 1) * row_dec;
     int frame_size = row_dec * avctx->height;
@@ -70,39 +70,37 @@ static int msrle_decode_pal4(AVCodecContext *avctx, AVPicture *pic,
                 pixel_ptr += stream_byte;
                 FETCH_NEXT_STREAM_BYTE();
                 row_ptr -= stream_byte * row_dec;
-        } else {
-            // copy pixels from encoded stream
-            odd_pixel =  stream_byte & 1;
-            rle_code = (stream_byte + 1) / 2;
-            extra_byte = rle_code & 0x01;
-            if ((row_ptr + pixel_ptr + stream_byte > frame_size) ||
-                (row_ptr < 0)) {
-                av_log(avctx, AV_LOG_ERROR, " MS RLE: frame ptr just went out of bounds (1)\n");
-                return -1;
-            }
+            } else {
+                // copy pixels from encoded stream
+                odd_pixel =  stream_byte & 1;
+                rle_code = (stream_byte + 1) / 2;
+                extra_byte = rle_code & 0x01;
+                if (row_ptr + pixel_ptr + stream_byte > frame_size) {
+                    av_log(avctx, AV_LOG_ERROR, " MS RLE: frame ptr just went out of bounds (1)\n");
+                    return -1;
+                }
 
-            for (i = 0; i < rle_code; i++) {
-                if (pixel_ptr >= avctx->width)
-                    break;
-                FETCH_NEXT_STREAM_BYTE();
-                pic->data[0][row_ptr + pixel_ptr] = stream_byte >> 4;
-                pixel_ptr++;
-                if (i + 1 == rle_code && odd_pixel)
-                    break;
-                if (pixel_ptr >= avctx->width)
-                    break;
-                pic->data[0][row_ptr + pixel_ptr] = stream_byte & 0x0F;
-                pixel_ptr++;
-            }
+                for (i = 0; i < rle_code; i++) {
+                    if (pixel_ptr >= avctx->width)
+                        break;
+                    FETCH_NEXT_STREAM_BYTE();
+                    pic->data[0][row_ptr + pixel_ptr] = stream_byte >> 4;
+                    pixel_ptr++;
+                    if (i + 1 == rle_code && odd_pixel)
+                        break;
+                    if (pixel_ptr >= avctx->width)
+                        break;
+                    pic->data[0][row_ptr + pixel_ptr] = stream_byte & 0x0F;
+                    pixel_ptr++;
+                }
 
-            // if the RLE code is odd, skip a byte in the stream
-            if (extra_byte)
-              stream_ptr++;
+                // if the RLE code is odd, skip a byte in the stream
+                if (extra_byte)
+                    stream_ptr++;
             }
         } else {
             // decode a run of data
-            if ((row_ptr + pixel_ptr + stream_byte > frame_size) ||
-                (row_ptr < 0)) {
+            if (row_ptr + pixel_ptr + stream_byte > frame_size) {
                 av_log(avctx, AV_LOG_ERROR, " MS RLE: frame ptr just went out of bounds (1)\n");
                 return -1;
             }
@@ -136,11 +134,12 @@ static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic, int de
     uint8_t *output, *output_end;
     const uint8_t* src = data;
     int p1, p2, line=avctx->height - 1, pos=0, i;
-    uint16_t av_uninit(pix16);
-    uint32_t av_uninit(pix32);
+    uint16_t pix16;
+    uint32_t pix32;
+    unsigned int width= FFABS(pic->linesize[0]) / (depth >> 3);
 
-    output = pic->data[0] + (avctx->height - 1) * pic->linesize[0];
-    output_end = pic->data[0] + (avctx->height) * pic->linesize[0];
+    output     = pic->data[0] + (avctx->height - 1) * pic->linesize[0];
+    output_end = pic->data[0] +  avctx->height      * pic->linesize[0];
     while(src < data + srcsize) {
         p1 = *src++;
         if(p1 == 0) { //Escape code
@@ -159,11 +158,11 @@ static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic, int de
                 p1 = *src++;
                 p2 = *src++;
                 line -= p2;
-                if (line < 0){
+                pos += p1;
+                if (line < 0 || pos >= width){
                     av_log(avctx, AV_LOG_ERROR, "Skip beyond picture bounds\n");
                     return -1;
                 }
-                pos += p1;
                 output = pic->data[0] + line * pic->linesize[0] + pos * (depth >> 3);
                 continue;
             }
@@ -257,4 +256,3 @@ int ff_msrle_decode(AVCodecContext *avctx, AVPicture *pic, int depth,
         return -1;
     }
 }
-