[FFmpeg-cvslog] lagarith: Fix out of array reads.

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Wed Feb  8 22:50:21 2012 +0100| [69494fd5c50742cb7d9ad9ca45b154ab9c33fa19] | committer: Michael Niedermayer

lagarith: Fix out of array reads.

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=69494fd5c50742cb7d9ad9ca45b154ab9c33fa19
---

 libavcodec/lagarith.c |    9 +++++----
 1 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/libavcodec/lagarith.c b/libavcodec/lagarith.c
index ef4799c..c72de2d 100644
--- a/libavcodec/lagarith.c
+++ b/libavcodec/lagarith.c
@@ -247,14 +247,15 @@ static void lag_pred_line(LagarithContext *l, uint8_t *buf,
 {
     int L, TL;
 
-    /* Left pixel is actually prev_row[width] */
-    L = buf[width - stride - 1];
     if (!line) {
         /* Left prediction only for first line */
         L = l->dsp.add_hfyu_left_prediction(buf + 1, buf + 1,
                                             width - 1, buf[0]);
         return;
-    } else if (line == 1) {
+    }
+    /* Left pixel is actually prev_row[width] */
+    L = buf[width - stride - 1];
+    if (line == 1) {
         /* Second line, left predict first pixel, the rest of the line is median predicted
          * NOTE: In the case of RGB this pixel is top predicted */
         TL = l->avctx->pix_fmt == PIX_FMT_YUV420P ? buf[-stride] : L;
@@ -498,7 +499,7 @@ static int lag_decode_frame(AVCodecContext *avctx,
 
         if (!l->rgb_planes) {
             l->rgb_stride = FFALIGN(avctx->width, 16);
-            l->rgb_planes = av_malloc(l->rgb_stride * avctx->height * planes);
+            l->rgb_planes = av_malloc(l->rgb_stride * avctx->height * planes + 16);
             if (!l->rgb_planes) {
                 av_log(avctx, AV_LOG_ERROR, "cannot allocate temporary buffer\n");
                 return AVERROR(ENOMEM);