From d8b45f7961dd7ad73fbe703f5b7ab600c876cde3 Mon Sep 17 00:00:00 2001 From: Alex Beregszaszi Date: Tue, 14 Nov 2006 19:19:13 +0000 Subject: Fix possible overflows. Found by Steven Johnson Originally committed as revision 7065 to svn://svn.ffmpeg.org/ffmpeg/trunk --- libavcodec/flicvideo.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) (limited to 'libavcodec/flicvideo.c') diff --git a/libavcodec/flicvideo.c b/libavcodec/flicvideo.c index f53aabfad9..0e6f5bdcec 100644 --- a/libavcodec/flicvideo.c +++ b/libavcodec/flicvideo.c @@ -156,7 +156,7 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx, int starting_line; signed short line_packets; int y_ptr; - signed char byte_run; + int byte_run; int pixel_skip; int pixel_countdown; unsigned char *pixels; @@ -258,7 +258,7 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx, pixel_skip = buf[stream_ptr++]; pixel_ptr += pixel_skip; pixel_countdown -= pixel_skip; - byte_run = buf[stream_ptr++]; + byte_run = (signed char)(buf[stream_ptr++]); if (byte_run < 0) { byte_run = -byte_run; palette_idx1 = buf[stream_ptr++]; @@ -301,7 +301,7 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx, pixel_skip = buf[stream_ptr++]; pixel_ptr += pixel_skip; pixel_countdown -= pixel_skip; - byte_run = buf[stream_ptr++]; + byte_run = (signed char)(buf[stream_ptr++]); if (byte_run > 0) { CHECK_PIXEL_PTR(byte_run); for (j = 0; j < byte_run; j++, pixel_countdown--) { @@ -341,7 +341,7 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx, stream_ptr++; pixel_countdown = s->avctx->width; while (pixel_countdown > 0) { - byte_run = buf[stream_ptr++]; + byte_run = (signed char)(buf[stream_ptr++]); if (byte_run > 0) { palette_idx1 = buf[stream_ptr++]; CHECK_PIXEL_PTR(byte_run); @@ -443,7 +443,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx, int compressed_lines; signed short line_packets; int y_ptr; - signed char byte_run; + int byte_run; int pixel_skip; int pixel_countdown; unsigned char *pixels; @@ -503,7 +503,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx, pixel_skip = buf[stream_ptr++]; pixel_ptr += (pixel_skip*2); /* Pixel is 2 bytes wide */ pixel_countdown -= pixel_skip; - byte_run = buf[stream_ptr++]; + byte_run = (signed char)(buf[stream_ptr++]); if (byte_run < 0) { byte_run = -byte_run; pixel = LE_16(&buf[stream_ptr]); @@ -549,7 +549,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx, pixel_countdown = (s->avctx->width * 2); while (pixel_countdown > 0) { - byte_run = buf[stream_ptr++]; + byte_run = (signed char)(buf[stream_ptr++]); if (byte_run > 0) { palette_idx1 = buf[stream_ptr++]; CHECK_PIXEL_PTR(byte_run); @@ -603,7 +603,7 @@ static int flic_decode_frame_15_16BPP(AVCodecContext *avctx, pixel_countdown = s->avctx->width; /* Width is in pixels, not bytes */ while (pixel_countdown > 0) { - byte_run = buf[stream_ptr++]; + byte_run = (signed char)(buf[stream_ptr++]); if (byte_run > 0) { pixel = LE_16(&buf[stream_ptr]); stream_ptr += 2; -- cgit v1.2.3