X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fpnm_parser.c;h=a822c17a2e932e107e8487cc2083e6df782c0fb2;hb=30f7021aa0be2c978aefb73894b643c9bafbf51c;hp=de0e32ba9ce60aaf1bbdeb56be1347d22937d7c9;hpb=e645d7a6d452df83cedcbb1d6708429ceea156da;p=ffmpeg

diff --git a/libavcodec/pnm_parser.c b/libavcodec/pnm_parser.c
index de0e32ba9ce..a822c17a2e9 100644
--- a/libavcodec/pnm_parser.c
+++ b/libavcodec/pnm_parser.c
@@ -41,8 +41,11 @@ static int pnm_parse(AVCodecParserContext *s, AVCodecContext *avctx,
     int next = END_NOT_FOUND;
     int skip = 0;
 
-    for (; pc->overread > 0; pc->overread--) {
-        pc->buffer[pc->index++]= pc->buffer[pc->overread_index++];
+    if (pc->overread > 0) {
+        memmove(pc->buffer + pc->index, pc->buffer + pc->overread_index, pc->overread);
+        pc->index          += pc->overread;
+        pc->overread_index += pc->overread;
+        pc->overread = 0;
     }
 
     if (pnmpc->remaining_bytes) {
@@ -69,6 +72,7 @@ retry:
         if (pnmctx.bytestream < pnmctx.bytestream_end) {
             if (pc->index) {
                 pc->index = 0;
+                pnmpc->ascii_scan = 0;
             } else {
                 unsigned step = FFMAX(1, pnmctx.bytestream - pnmctx.bytestream_start);
 
@@ -91,8 +95,11 @@ retry:
             sync = bs;
             c = *bs++;
             if (c == '#')  {
-                while (c != '\n' && bs < end)
-                    c = *bs++;
+                uint8_t *match = memchr(bs, '\n', end-bs);
+                if (match)
+                    bs = match + 1;
+                else
+                    break;
             } else if (c == 'P') {
                 next = bs - pnmctx.bytestream_start + skip - 1;
                 pnmpc->ascii_scan = 0;
@@ -102,8 +109,10 @@ retry:
         if (next == END_NOT_FOUND)
             pnmpc->ascii_scan = sync - pnmctx.bytestream + skip;
     } else {
-        next = pnmctx.bytestream - pnmctx.bytestream_start + skip
-               + av_image_get_buffer_size(avctx->pix_fmt, avctx->width, avctx->height, 1);
+        int ret = av_image_get_buffer_size(avctx->pix_fmt, avctx->width, avctx->height, 1);
+        next = pnmctx.bytestream - pnmctx.bytestream_start + skip;
+        if (ret >= 0 && next + (uint64_t)ret <= INT_MAX)
+            next += ret;
     }
     if (next != END_NOT_FOUND && pnmctx.bytestream_start != buf + skip)
         next -= pc->index;