diff --git a/libavcodec/h261dec.c b/libavcodec/h261dec.c index f286d23635ecb8d4cc90198abeb8a8b532f9d411..c9470b1296fb7675f8764649a4719d6424772351 100644 --- a/libavcodec/h261dec.c +++ b/libavcodec/h261dec.c @@ -305,6 +305,7 @@ static int h261_decode_block(H261Context *h, int16_t *block, int n, int coded) } { OPEN_READER(re, &s->gb); + i--; // offset by -1 to allow direct indexing of scan_table for (;;) { UPDATE_CACHE(re, &s->gb); GET_RL_VLC(level, run, re, &s->gb, rl->rl_vlc[0], TCOEFF_VLC_BITS, 2, 0); @@ -330,17 +331,17 @@ static int h261_decode_block(H261Context *h, int16_t *block, int n, int coded) SKIP_COUNTER(re, &s->gb, 1); } i += run; - if (i > 64) { + if (i >= 64) { av_log(s->avctx, AV_LOG_ERROR, "run overflow at %dx%d\n", s->mb_x, s->mb_y); return -1; } - j = scan_table[i-1]; + j = scan_table[i]; block[j] = level; } CLOSE_READER(re, &s->gb); } - s->block_last_index[n] = i - 1; + s->block_last_index[n] = i; return 0; } diff --git a/libavcodec/ituh263dec.c b/libavcodec/ituh263dec.c index ad5a3cbc491f87c0d2c6f0c70fc9cd7fdb27c0c0..168ac7489f2a6a4644caeee0d940f20e09d337fa 100644 --- a/libavcodec/ituh263dec.c +++ b/libavcodec/ituh263dec.c @@ -481,6 +481,7 @@ static int h263_decode_block(MpegEncContext * s, int16_t * block, retry: { OPEN_READER(re, &s->gb); + i--; // offset by -1 to allow direct indexing of scan_table for(;;) { UPDATE_CACHE(re, &s->gb); GET_RL_VLC(level, run, re, &s->gb, rl->rl_vlc[0], TEX_VLC_BITS, 2, 0); @@ -529,9 +530,9 @@ retry: SKIP_COUNTER(re, &s->gb, 1); } i += run; - if (i > 64){ - // redo update without last flag - i = i - run + ((run-1)&63); + if (i >= 64){ + // redo update without last flag, revert -1 offset + i = i - run + ((run-1)&63) + 1; if (i < 64) { // only last marker, no overrun block[scan_table[i]] = level; @@ -549,7 +550,7 @@ retry: av_log(s->avctx, AV_LOG_ERROR, "run overflow at %dx%d i:%d\n", s->mb_x, s->mb_y, s->mb_intra); return -1; } - j = scan_table[i-1]; + j = scan_table[i]; block[j] = level; } CLOSE_READER(re, &s->gb);