[FFmpeg-cvslog] msrledec: check bounds before constructing a possibly invalid pointer,

[Anton Khirnov]

ffmpeg | branch: release/0.10 | Anton Khirnov <anton at khirnov.net> | Tue Jan 29 12:24:09 2013 +0100| [4160398e2a3e229e29dff03300aaf630e726a768] | committer: Reinhard Tartler

msrledec: check bounds before constructing a possibly invalid pointer,

CC:libav-stable at libav.org
(cherry picked from commit 9bd6375d5f16842306dcecde637ffe605acda26b)

Signed-off-by: Reinhard Tartler <siretart at tauware.de>
(cherry picked from commit b7765d00f911fe0f8fcda21b93a540f27d2ba2f5)

Signed-off-by: Reinhard Tartler <siretart at tauware.de>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4160398e2a3e229e29dff03300aaf630e726a768
---

 libavcodec/msrledec.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/msrledec.c b/libavcodec/msrledec.c
index 003122e..821311b 100644
--- a/libavcodec/msrledec.c
+++ b/libavcodec/msrledec.c
@@ -144,8 +144,7 @@ static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic,
         if(p1 == 0) { //Escape code
             p2 = bytestream2_get_byte(gb);
             if(p2 == 0) { //End-of-line
-                output = pic->data[0] + (--line) * pic->linesize[0];
-                if (line < 0) {
+                if (--line < 0) {
                     if (bytestream2_get_be16(gb) == 1) { // end-of-picture
                         return 0;
                     } else {
@@ -155,6 +154,7 @@ static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic,
                         return AVERROR_INVALIDDATA;
                     }
                 }
+                output = pic->data[0] + line * pic->linesize[0];
                 pos = 0;
                 continue;
             } else if(p2 == 1) { //End-of-picture