diff options
Diffstat (limited to 'chromium/third_party/ffmpeg/libavcodec/iff.c')
-rw-r--r-- | chromium/third_party/ffmpeg/libavcodec/iff.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/chromium/third_party/ffmpeg/libavcodec/iff.c b/chromium/third_party/ffmpeg/libavcodec/iff.c index e71f5b00b96..f08a0f70cef 100644 --- a/chromium/third_party/ffmpeg/libavcodec/iff.c +++ b/chromium/third_party/ffmpeg/libavcodec/iff.c @@ -488,17 +488,21 @@ static int decode_byterun(uint8_t *dst, int dst_size, unsigned length; const int8_t value = *buf++; if (value >= 0) { - length = value + 1; - memcpy(dst + x, buf, FFMIN3(length, dst_size - x, buf_end - buf)); + length = FFMIN3(value + 1, dst_size - x, buf_end - buf); + memcpy(dst + x, buf, length); buf += length; } else if (value > -128) { - length = -value + 1; - memset(dst + x, *buf++, FFMIN(length, dst_size - x)); + length = FFMIN(-value + 1, dst_size - x); + memset(dst + x, *buf++, length); } else { // noop continue; } x += length; } + if (x < dst_size) { + av_log(NULL, AV_LOG_WARNING, "decode_byterun ended before plane size\n"); + memset(dst+x, 0, dst_size - x); + } return buf - buf_start; } |