[FFmpeg-cvslog] dfa: fix out of array write in decode_wdlt()

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Fri Apr 13 22:52:16 2012 +0200| [d1c95d2ce39560e251fdb14f4af91b04fd7b845c] | committer: Michael Niedermayer

dfa: fix out of array write in decode_wdlt()

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d1c95d2ce39560e251fdb14f4af91b04fd7b845c
---

 libavcodec/dfa.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/libavcodec/dfa.c b/libavcodec/dfa.c
index d8516b2..13637d6 100644
--- a/libavcodec/dfa.c
+++ b/libavcodec/dfa.c
@@ -242,6 +242,8 @@ static int decode_wdlt(GetByteContext *gb, uint8_t *frame, int width, int height
             frame    += delta;
             segments = bytestream2_get_le16(gb);
         }
+        if (frame_end <= frame)
+            return -1;
         if (segments & 0x8000) {
             frame[width - 1] = segments & 0xFF;
             segments = bytestream2_get_le16(gb);