[Ffmpeg-cvslog] r7065 - trunk/libavcodec/flicvideo.c

[alex]

Author: alex
Date: Tue Nov 14 20:19:13 2006
New Revision: 7065

Modified:
   trunk/libavcodec/flicvideo.c

Log:
Fix possible overflows. Found by Steven Johnson

Modified: trunk/libavcodec/flicvideo.c
==============================================================================
--- trunk/libavcodec/flicvideo.c	(original)
+++ trunk/libavcodec/flicvideo.c	Tue Nov 14 20:19:13 2006
@@ -156,7 +156,7 @@
     int starting_line;
     signed short line_packets;
     int y_ptr;
-    signed char byte_run;
+    int byte_run;
     int pixel_skip;
     int pixel_countdown;
     unsigned char *pixels;
@@ -258,7 +258,7 @@
                         pixel_skip = buf[stream_ptr++];
                         pixel_ptr += pixel_skip;
                         pixel_countdown -= pixel_skip;
-                        byte_run = buf[stream_ptr++];
+                        byte_run = (signed char)(buf[stream_ptr++]);
                         if (byte_run < 0) {
                             byte_run = -byte_run;
                             palette_idx1 = buf[stream_ptr++];
@@ -301,7 +301,7 @@
                         pixel_skip = buf[stream_ptr++];
                         pixel_ptr += pixel_skip;
                         pixel_countdown -= pixel_skip;
-                        byte_run = buf[stream_ptr++];
+                        byte_run = (signed char)(buf[stream_ptr++]);
                         if (byte_run > 0) {
                             CHECK_PIXEL_PTR(byte_run);
                             for (j = 0; j < byte_run; j++, pixel_countdown--) {
@@ -341,7 +341,7 @@
                 stream_ptr++;
                 pixel_countdown = s->avctx->width;
                 while (pixel_countdown > 0) {
-                    byte_run = buf[stream_ptr++];
+                    byte_run = (signed char)(buf[stream_ptr++]);
                     if (byte_run > 0) {
                         palette_idx1 = buf[stream_ptr++];
                         CHECK_PIXEL_PTR(byte_run);
@@ -443,7 +443,7 @@
     int compressed_lines;
     signed short line_packets;
     int y_ptr;
-    signed char byte_run;
+    int byte_run;
     int pixel_skip;
     int pixel_countdown;
     unsigned char *pixels;
@@ -503,7 +503,7 @@
                         pixel_skip = buf[stream_ptr++];
                         pixel_ptr += (pixel_skip*2); /* Pixel is 2 bytes wide */
                         pixel_countdown -= pixel_skip;
-                        byte_run = buf[stream_ptr++];
+                        byte_run = (signed char)(buf[stream_ptr++]);
                         if (byte_run < 0) {
                             byte_run = -byte_run;
                             pixel    = LE_16(&buf[stream_ptr]);
@@ -549,7 +549,7 @@
                 pixel_countdown = (s->avctx->width * 2);
 
                 while (pixel_countdown > 0) {
-                    byte_run = buf[stream_ptr++];
+                    byte_run = (signed char)(buf[stream_ptr++]);
                     if (byte_run > 0) {
                         palette_idx1 = buf[stream_ptr++];
                         CHECK_PIXEL_PTR(byte_run);
@@ -603,7 +603,7 @@
                 pixel_countdown = s->avctx->width; /* Width is in pixels, not bytes */
 
                 while (pixel_countdown > 0) {
-                    byte_run = buf[stream_ptr++];
+                    byte_run = (signed char)(buf[stream_ptr++]);
                     if (byte_run > 0) {
                         pixel    = LE_16(&buf[stream_ptr]);
                         stream_ptr += 2;