Commit debbcfae authored by Michael Niedermayer's avatar Michael Niedermayer

bmv: fix apparent sign error in the frame_off check

Fixes part of Ticket1373
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 679c578c
...@@ -143,7 +143,7 @@ static int decode_bmv_frame(const uint8_t *source, int src_len, uint8_t *frame, ...@@ -143,7 +143,7 @@ static int decode_bmv_frame(const uint8_t *source, int src_len, uint8_t *frame,
switch (mode) { switch (mode) {
case 1: case 1:
if (forward) { if (forward) {
if (dst - frame + SCREEN_WIDE < frame_off || if (dst - frame + SCREEN_WIDE < -frame_off ||
frame_end - dst < frame_off + len) frame_end - dst < frame_off + len)
return -1; return -1;
for (i = 0; i < len; i++) for (i = 0; i < len; i++)
...@@ -151,7 +151,7 @@ static int decode_bmv_frame(const uint8_t *source, int src_len, uint8_t *frame, ...@@ -151,7 +151,7 @@ static int decode_bmv_frame(const uint8_t *source, int src_len, uint8_t *frame,
dst += len; dst += len;
} else { } else {
dst -= len; dst -= len;
if (dst - frame + SCREEN_WIDE < frame_off || if (dst - frame + SCREEN_WIDE < -frame_off ||
frame_end - dst < frame_off + len) frame_end - dst < frame_off + len)
return -1; return -1;
for (i = len - 1; i >= 0; i--) for (i = len - 1; i >= 0; i--)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment