Revision 26830975 libavcodec/faxcompr.c

View differences:

libavcodec/faxcompr.c
156 156
}
157 157

  
158 158
static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb,
159
                                 int width, int *runs, const int *runend, const int *ref)
159
                                 unsigned int width, int *runs, const int *runend, const int *ref)
160 160
{
161
    int mode = 0, offs = 0, run = 0, saved_run = 0, t;
161
    int mode = 0, saved_run = 0, t;
162 162
    int run_off = *ref++;
163
    unsigned int offs=0, run= 0;
163 164

  
164 165
    runend--; // for the last written 0
165 166

  
......
200 201
                }
201 202
                saved_run = 0;
202 203
                offs += run;
203
                if(offs > width){
204
                if(offs > width || run > width){
204 205
                    av_log(avctx, AV_LOG_ERROR, "Run went out of bounds\n");
205 206
                    return -1;
206 207
                }

Also available in: Unified diff