jpeglsdec: Prevent out of array write.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
13 years ago · 00ab9cdae1
parent dda713f870
commit 00ab9cdae1
1 changed files with 3 additions and 0 deletions
--- a/libavcodec/jpeglsdec.c
+++ b/libavcodec/jpeglsdec.c
@ -198,6 +198,9 @@ static inline void ls_decode_line(JLSState *state, MJpegDecodeContext *s, void *
            r = ff_log2_run[state->run_index[comp]];
            if(r)
                r = get_bits_long(&s->gb, r);
+            if(x + r * stride > w) {
+                r = (w - x) / stride;
+            }
            for(i = 0; i < r; i++) {
                W(dst, x, Ra);
                x += stride;