Revision d3834587 libavcodec/dfa.c
libavcodec/dfa.c | ||
---|---|---|
81 | 81 |
v = bytestream_get_le16(&src); |
82 | 82 |
offset = (v & 0x1FFF) << 1; |
83 | 83 |
count = ((v >> 13) + 2) << 1; |
84 |
if (frame - offset < frame_start || frame_end - frame < count)
|
|
84 |
if (frame - frame_start < offset || frame_end - frame < count)
|
|
85 | 85 |
return -1; |
86 | 86 |
av_memcpy_backptr(frame, offset, count); |
87 | 87 |
frame += count; |
... | ... | |
117 | 117 |
v = bytestream_get_le16(&src); |
118 | 118 |
offset = (v & 0x1FFF) << 1; |
119 | 119 |
count = ((v >> 13) + 2) << 1; |
120 |
if (frame - offset < frame_start || frame_end - frame < count)
|
|
120 |
if (frame - frame_start < offset || frame_end - frame < count)
|
|
121 | 121 |
return -1; |
122 | 122 |
// can't use av_memcpy_backptr() since it can overwrite following pixels |
123 | 123 |
for (v = 0; v < count; v++) |
... | ... | |
157 | 157 |
v = bytestream_get_le16(&src); |
158 | 158 |
offset = (v & 0x1FFF) << 2; |
159 | 159 |
count = ((v >> 13) + 2) << 1; |
160 |
if (frame - offset < frame_start || frame_end - frame < count*2 + width)
|
|
160 |
if (frame - frame_start < offset || frame_end - frame < count*2 + width)
|
|
161 | 161 |
return -1; |
162 | 162 |
for (i = 0; i < count; i++) { |
163 | 163 |
frame[0] = frame[1] = |
Also available in: Unified diff