[FFmpeg-cvslog] r14214 - trunk/libavcodec/lzw.c

[reimar]

Author: reimar
Date: Sun Jul 13 22:03:57 2008
New Revision: 14214

Log:
check that csize in ff_lzw_decode_init is < LZW_MAXBITS, <= is not enough and
might read outside the prefix array

Modified:
   trunk/libavcodec/lzw.c

Modified: trunk/libavcodec/lzw.c
==============================================================================
--- trunk/libavcodec/lzw.c	(original)
+++ trunk/libavcodec/lzw.c	Sun Jul 13 22:03:57 2008
@@ -131,7 +131,7 @@ int ff_lzw_decode_init(LZWState *p, int 
 {
     struct LZWState *s = (struct LZWState *)p;
 
-    if(csize < 1 || csize > LZW_MAXBITS)
+    if(csize < 1 || csize >= LZW_MAXBITS)
         return -1;
     /* read buffer */
     s->pbuf = buf;