Revision d3834587 libavcodec/dfa.c

View differences:

libavcodec/dfa.c
81 81
            v = bytestream_get_le16(&src);
82 82
            offset = (v & 0x1FFF) << 1;
83 83
            count = ((v >> 13) + 2) << 1;
84
            if (frame - offset < frame_start || frame_end - frame < count)
84
            if (frame - frame_start < offset || frame_end - frame < count)
85 85
                return -1;
86 86
            av_memcpy_backptr(frame, offset, count);
87 87
            frame += count;
......
117 117
            v = bytestream_get_le16(&src);
118 118
            offset = (v & 0x1FFF) << 1;
119 119
            count = ((v >> 13) + 2) << 1;
120
            if (frame - offset < frame_start || frame_end - frame < count)
120
            if (frame - frame_start < offset || frame_end - frame < count)
121 121
                return -1;
122 122
            // can't use av_memcpy_backptr() since it can overwrite following pixels
123 123
            for (v = 0; v < count; v++)
......
157 157
            v = bytestream_get_le16(&src);
158 158
            offset = (v & 0x1FFF) << 2;
159 159
            count = ((v >> 13) + 2) << 1;
160
            if (frame - offset < frame_start || frame_end - frame < count*2 + width)
160
            if (frame - frame_start < offset || frame_end - frame < count*2 + width)
161 161
                return -1;
162 162
            for (i = 0; i < count; i++) {
163 163
                frame[0] = frame[1] =

Also available in: Unified diff