[FFmpeg-cvslog] r22074 - in branches/0.5: . libavcodec/huffyuv.c

[siretart]

Author: siretart
Date: Fri Feb 26 11:56:46 2010
New Revision: 22074

Log:
Make sure we dont read over the end.
Fixes issue1237.

backport r19322 by michael

Modified:
   branches/0.5/   (props changed)
   branches/0.5/libavcodec/huffyuv.c

Modified: branches/0.5/libavcodec/huffyuv.c
==============================================================================
--- branches/0.5/libavcodec/huffyuv.c	Fri Feb 26 10:13:40 2010	(r22073)
+++ branches/0.5/libavcodec/huffyuv.c	Fri Feb 26 11:56:46 2010	(r22074)
@@ -728,10 +728,17 @@ static void decode_422_bitstream(HYuvCon
 
     count/=2;
 
+    if(count >= (s->gb.size_in_bits - get_bits_count(&s->gb))/(31*4)){
+        for(i=0; i<count && get_bits_count(&s->gb) < s->gb.size_in_bits; i++){
+            READ_2PIX(s->temp[0][2*i  ], s->temp[1][i], 1);
+            READ_2PIX(s->temp[0][2*i+1], s->temp[2][i], 2);
+        }
+    }else{
     for(i=0; i<count; i++){
         READ_2PIX(s->temp[0][2*i  ], s->temp[1][i], 1);
         READ_2PIX(s->temp[0][2*i+1], s->temp[2][i], 2);
     }
+    }
 }
 
 static void decode_gray_bitstream(HYuvContext *s, int count){
@@ -739,9 +746,15 @@ static void decode_gray_bitstream(HYuvCo
 
     count/=2;
 
+    if(count >= (s->gb.size_in_bits - get_bits_count(&s->gb))/(31*2)){
+        for(i=0; i<count && get_bits_count(&s->gb) < s->gb.size_in_bits; i++){
+            READ_2PIX(s->temp[0][2*i  ], s->temp[0][2*i+1], 0);
+        }
+    }else{
     for(i=0; i<count; i++){
         READ_2PIX(s->temp[0][2*i  ], s->temp[0][2*i+1], 0);
     }
+    }
 }
 
 #if CONFIG_HUFFYUV_ENCODER || CONFIG_FFVHUFF_ENCODER