mirror of
https://git.ffmpeg.org/ffmpeg.git
synced 2026-06-16 04:32:47 +02:00
avcodec/hdrdec: fix pixel count decrement in RLE decompress loop
The w variable counts pixels, not bytes. The non-RLE path correctly
uses w-- (one pixel = 4 bytes), but the RLE path uses w -= 4, causing
the loop to terminate after roughly 1/4 of the expected pixels.
The w -= 4 was introduced in 14e99cb472 which moved the decrement
inside the loop to fix an OOB write (clusterfuzz-5423041009549312).
The move was correct, but the decrement value should have been 1 to
match the non-RLE path.
Signed-off-by: João Neves <joaocns0@protonmail.com>
This commit is contained in:
committed by
Marton Balint
parent
daedf4012d
commit
2c71a28bf0
+1
-1
@@ -72,7 +72,7 @@ static int decompress(uint8_t *scanline, int w, GetByteContext *gb, const uint8_
|
||||
for (int i = run << rshift; i > 0 && w > 0 && scanline >= start + 4; i--) {
|
||||
memcpy(scanline, scanline - 4, 4);
|
||||
scanline += 4;
|
||||
w -= 4;
|
||||
w--;
|
||||
}
|
||||
rshift += 8;
|
||||
if (rshift > 16)
|
||||
|
||||
Reference in New Issue
Block a user