xxan: check ybuf index before use.

Fixes out of array access

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

diff --git a/libavcodec/xxan.c b/libavcodec/xxan.c
index de1ea7f0e4b8e2824b0e304de614971505b1044c..2c33f07a71b1d8ff381fa4a6b310854cc0964672 100644 (file)
--- a/libavcodec/xxan.c
+++ b/libavcodec/xxan.c
@@ -289,7 +289,8 @@ static int xan_decode_frame_type0(AVCodecContext *avctx)
             ybuf[j+1] = cur << 1;
             last = cur;
         }
-        ybuf[j] = last << 1;
+        if(j < avctx->width)
+            ybuf[j] = last << 1;
         prev_buf = ybuf;
         ybuf += avctx->width;
     }