And another sechole ...

Originally committed as revision 16346 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavcodec/faxcompr.c b/libavcodec/faxcompr.c
index 72ad8b95daea686192a823192729578ee187e07c..424de599b540d23bd2840080e9b5d36936cc4b1b 100644 (file)
--- a/libavcodec/faxcompr.c
+++ b/libavcodec/faxcompr.c
@@ -217,7 +217,7 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb,
             else
                 run_off -= *--ref;
             offs += run;
-            if(offs > width){
+            if(offs > width || run > width){
                 av_log(avctx, AV_LOG_ERROR, "Run went out of bounds\n");
                 return -1;
             }