mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2024-11-26 19:01:44 +02:00
avcodec/sgirledec: fix infinite loop in decode_sgirle8()
Fixes #2985. Reported-by: Piotr Bandurski <ami_stuff@o2.pl> Signed-off-by: Paul B Mahol <onemda@gmail.com>
This commit is contained in:
parent
601eab2bbf
commit
b00fb157ba
@ -82,6 +82,8 @@ static int decode_sgirle8(AVCodecContext *avctx, uint8_t *dst, const uint8_t *sr
|
||||
if (v > 0 && v < 0xC0) {
|
||||
do {
|
||||
int length = FFMIN(v, width - x);
|
||||
if (length <= 0)
|
||||
break;
|
||||
memset(dst + y*linesize + x, RGB332_TO_BGR8(*src), length);
|
||||
INC_XY(length);
|
||||
v -= length;
|
||||
@ -91,7 +93,7 @@ static int decode_sgirle8(AVCodecContext *avctx, uint8_t *dst, const uint8_t *sr
|
||||
v -= 0xC0;
|
||||
do {
|
||||
int length = FFMIN3(v, width - x, src_end - src);
|
||||
if (src_end - src < length)
|
||||
if (src_end - src < length || length <= 0)
|
||||
break;
|
||||
memcpy_rgb332_to_bgr8(dst + y*linesize + x, src, length);
|
||||
INC_XY(length);
|
||||
|
Loading…
Reference in New Issue
Block a user