[FFmpeg-cvslog] faxcompr: Dont read ref when the end has been reached in pass mode

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Tue Feb 12 22:14:50 2013 +0100| [6f9ae391deeab618fc9c0080d05b97afa29ddf81] | committer: Michael Niedermayer

faxcompr: Dont read ref when the end has been reached in pass mode

Fixes reading over the end

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6f9ae391deeab618fc9c0080d05b97afa29ddf81
---

 libavcodec/faxcompr.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/libavcodec/faxcompr.c b/libavcodec/faxcompr.c
index 3e51a3e..86be977 100644
--- a/libavcodec/faxcompr.c
+++ b/libavcodec/faxcompr.c
@@ -170,10 +170,12 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb,
             return -1;
         }
         if(!cmode){//pass mode
-            run_off += *ref++;
+            if(run_off < width)
+                run_off += *ref++;
             run = run_off - offs;
             offs= run_off;
-            run_off += *ref++;
+            if(run_off < width)
+                run_off += *ref++;
             if(offs > width){
                 av_log(avctx, AV_LOG_ERROR, "Run went out of bounds\n");
                 return -1;