From ac9d159015a88aa2721b271875d18482f713f354 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Storsj=C3=B6?= <martin@martin.st>
Date: Thu, 12 Sep 2013 12:10:18 +0300
Subject: [PATCH] proresdec: Properly make sure an index doesn't run past the
limit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
If idx equaled num_coeffs - 1 on entry to the loop, the previous
check failed to break out of the loop.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
---
libavcodec/proresdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/proresdec.c b/libavcodec/proresdec.c
index c13b76969b2..c3b480f18d9 100644
--- a/libavcodec/proresdec.c
+++ b/libavcodec/proresdec.c
@@ -496,7 +496,7 @@ static void unpack_alpha(GetBitContext *gb, uint16_t *dst, int num_coeffs,
dst[idx++] = alpha_val >> 6;
else
dst[idx++] = (alpha_val << 2) | (alpha_val >> 6);
- if (idx == num_coeffs - 1)
+ if (idx >= num_coeffs - 1)
break;
} while (get_bits1(gb));
val = get_bits(gb, 4);
--
GitLab