avcodec/hdrdec: fix pixel count decrement in RLE decompress loop

The w variable counts pixels, not bytes. The non-RLE path correctly
uses w-- (one pixel = 4 bytes), but the RLE path uses w -= 4, causing
the loop to terminate after roughly 1/4 of the expected pixels.

The w -= 4 was introduced in 14e99cb472 which moved the decrement
inside the loop to fix an OOB write (clusterfuzz-5423041009549312).
The move was correct, but the decrement value should have been 1 to
match the non-RLE path.

Signed-off-by: João Neves <joaocns0@protonmail.com>
This commit is contained in:
João Neves
2026-04-08 13:55:37 -07:00
committed by Marton Balint
parent daedf4012d
commit 2c71a28bf0
+1 -1
View File
@@ -72,7 +72,7 @@ static int decompress(uint8_t *scanline, int w, GetByteContext *gb, const uint8_
for (int i = run << rshift; i > 0 && w > 0 && scanline >= start + 4; i--) {
memcpy(scanline, scanline - 4, 4);
scanline += 4;
w -= 4;
w--;
}
rshift += 8;
if (rshift > 16)