avcodec/rl2: Fix undefined pointer arithmetic

Don't increment back_frame if it does not correspond
to a real buffer. To do this, handle copying from
the back frame separately from the "use coded value"
codepath; also use memcpy for the former, as the
chunks here are typically worth it.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>

libavcodec/rl2.c

@@ -69,13 +69,16 @@ static void rl2_rle_decode(Rl2Context *s, const uint8_t *in, int size,
     uint8_t *line_end;
 
     /** copy start of the background frame */
+    if (s->back_frame) {
     for (i = 0; i <= base_y; i++) {
-        if (s->back_frame)
             memcpy(out, back_frame, s->avctx->width);
         out        += stride;
         back_frame += s->avctx->width;
     }
     back_frame += base_x - s->avctx->width;
+    } else {
+        out += stride * (base_y + 1);
+    }
     line_end    = out - stride_adj;
     out        += base_x - stride;
 
@@ -89,16 +92,32 @@ static void rl2_rle_decode(Rl2Context *s, const uint8_t *in, int size,
             len = *in++;
             if (!len)
                 break;
+            val &= 0x7F;
         }
 
-        if (s->back_frame)
+        if (back_frame) {
+            if (!val) {
+                do {
+                    size_t copy = FFMIN(line_end - out, len);
+                    memcpy(out, back_frame, copy);
+                    out        += copy;
+                    back_frame += copy;
+                    len        -= copy;
+                    if (out == line_end) {
+                        if (out == out_end)
+                            return;
+                        out      += stride_adj;
+                        line_end += stride;
+                    }
+                } while (len > 0);
+                continue;
+            }
+            back_frame += len;
             val |= 0x80;
-        else
-            val &= ~0x80;
+        }
 
         while (len--) {
-            *out++ = (val == 0x80) ? *back_frame : val;
-            back_frame++;
+            *out++ = val;
             if (out == line_end) {
                 if (out == out_end)
                     return;
@@ -164,7 +183,9 @@ static av_cold int rl2_decode_init(AVCodecContext *avctx)
     back_size = avctx->extradata_size - EXTRADATA1_SIZE;
 
     if (back_size > 0) {
-        uint8_t *back_frame = av_mallocz(avctx->width*avctx->height);
+        /* The 254 are padding to ensure that pointer arithmetic stays within
+         * the buffer. */
+        uint8_t *back_frame = av_mallocz(avctx->width * avctx->height + 254);
         if (!back_frame)
             return AVERROR(ENOMEM);
         rl2_rle_decode(s, avctx->extradata + EXTRADATA1_SIZE, back_size,