[FFmpeg-cvslog] r21138 - trunk/libavcodec/tscc.c

[kostya]

Author: kostya
Date: Mon Jan 11 15:21:53 2010
New Revision: 21138

Log:
Fix two RLE buffer size calculations in TSCC decoder.
Spotted by Zhongtuan Ma.

Modified:
   trunk/libavcodec/tscc.c

Modified: trunk/libavcodec/tscc.c
==============================================================================
--- trunk/libavcodec/tscc.c	Mon Jan 11 14:36:58 2010	(r21137)
+++ trunk/libavcodec/tscc.c	Mon Jan 11 15:21:53 2010	(r21138)
@@ -107,7 +107,7 @@ static int decode_frame(AVCodecContext *
 
 
     if(zret != Z_DATA_ERROR)
-        ff_msrle_decode(avctx, (AVPicture*)&c->pic, c->bpp, c->decomp_buf, c->zstream.avail_out);
+        ff_msrle_decode(avctx, (AVPicture*)&c->pic, c->bpp, c->decomp_buf, c->decomp_size - c->zstream.avail_out);
 
     /* make the palette available on the way out */
     if (c->avctx->pix_fmt == PIX_FMT_PAL8) {
@@ -154,7 +154,8 @@ static av_cold int decode_init(AVCodecCo
              return -1;
     }
     c->bpp = avctx->bits_per_coded_sample;
-    c->decomp_size = (avctx->width * c->bpp + (avctx->width + 254) / 255 + 2) * avctx->height + 2;//RLE in the 'best' case
+    // buffer size for RLE 'best' case when 2-byte code preceeds each pixel and there may be padding after it too
+    c->decomp_size = (((avctx->width * c->bpp + 7) >> 3) + 3 * avctx->width + 2) * avctx->height + 2;
 
     /* Allocate decompression buffer */
     if (c->decomp_size) {