avcodec/rasc: fix decoding with AVFrame's negative linesize

libavcodec/rasc.c

@@ -379,8 +379,8 @@ static int decode_dlta(AVCodecContext *avctx,
     if (!s->frame2->data[0] || !s->frame1->data[0])
         return AVERROR_INVALIDDATA;
 
-    b1  = s->frame1->data[0] + s->frame1->linesize[0] * (y + h - 1) + x * s->bpp;
-    b2  = s->frame2->data[0] + s->frame2->linesize[0] * (y + h - 1) + x * s->bpp;
+    b1  = s->frame1->data[0] + s->frame1->linesize[0] * (int)(y + h - 1) + ((int)x) * s->bpp;
+    b2  = s->frame2->data[0] + s->frame2->linesize[0] * (int)(y + h - 1) + ((int)x) * s->bpp;
     cx = 0, cy = h;
     while (bytestream2_get_bytes_left(&dc) > 0) {
         int type = bytestream2_get_byte(&dc);
@@ -620,7 +620,7 @@ static void draw_cursor(AVCodecContext *avctx)
                 if (cr == s->cursor[0] && cg == s->cursor[1] && cb == s->cursor[2])
                     continue;
 
-                dst = s->frame->data[0] + s->frame->linesize[0] * (s->cursor_y + i) + (s->cursor_x + j);
+                dst = s->frame->data[0] + s->frame->linesize[0] * (int)(s->cursor_y + i) + (int)(s->cursor_x + j);
                 for (int k = 0; k < 256; k++) {
                     int pr = pal[k * 4 + 0];
                     int pg = pal[k * 4 + 1];
@@ -646,7 +646,7 @@ static void draw_cursor(AVCodecContext *avctx)
                     continue;
 
                 cr >>= 3; cg >>=3; cb >>= 3;
-                dst = s->frame->data[0] + s->frame->linesize[0] * (s->cursor_y + i) + 2 * (s->cursor_x + j);
+                dst = s->frame->data[0] + s->frame->linesize[0] * (int)(s->cursor_y + i) + 2 * (s->cursor_x + j);
                 AV_WL16(dst, cr | cg << 5 | cb << 10);
             }
         }
@@ -660,7 +660,7 @@ static void draw_cursor(AVCodecContext *avctx)
                 if (cr == s->cursor[0] && cg == s->cursor[1] && cb == s->cursor[2])
                     continue;
 
-                dst = s->frame->data[0] + s->frame->linesize[0] * (s->cursor_y + i) + 4 * (s->cursor_x + j);
+                dst = s->frame->data[0] + s->frame->linesize[0] * (int)(s->cursor_y + i) + 4 * (s->cursor_x + j);
                 dst[0] = cb;
                 dst[1] = cg;
                 dst[2] = cr;