From 86e59cc01df043e415b5e56cf4c31832133fbc8f Mon Sep 17 00:00:00 2001
From: Yartrebo <yartrebo@earthlink.net>
Date: Wed, 13 Apr 2005 01:57:19 +0000
Subject: [PATCH] Snow segfault bug in revision 1.43 patch by (Yartrebo
 /yartrebo earthlink net/)

Originally committed as revision 4126 to svn://svn.ffmpeg.org/ffmpeg/trunk
---
 libavcodec/snow.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/libavcodec/snow.c b/libavcodec/snow.c
index 26efe249df..ee77f1c252 100644
--- a/libavcodec/snow.c
+++ b/libavcodec/snow.c
@@ -2758,7 +2758,7 @@ static always_inline void predict_slice_buffered(SnowContext *s, slice_buffer *
             return;
 
         if(add){
-            for(y=block_w*mb_y; y<block_w*(mb_y+1); y++)
+            for(y=block_w*mb_y; y<FFMIN(h,block_w*(mb_y+1)); y++)
             {
 //                DWTELEM * line = slice_buffer_get_line(sb, y);
                 DWTELEM * line = sb->line[y];
@@ -2772,7 +2772,7 @@ static always_inline void predict_slice_buffered(SnowContext *s, slice_buffer *
                 }
             }
         }else{
-            for(y=block_w*mb_y; y<block_w*(mb_y+1); y++)
+            for(y=block_w*mb_y; y<FFMIN(h,block_w*(mb_y+1)); y++)
             {
 //                DWTELEM * line = slice_buffer_get_line(sb, y);
                 DWTELEM * line = sb->line[y];
@@ -2826,7 +2826,7 @@ static always_inline void predict_slice(SnowContext *s, DWTELEM *buf, int plane_
             return;
 
         if(add){
-            for(y=block_w*mb_y; y<block_w*(mb_y+1); y++){
+            for(y=block_w*mb_y; y<FFMIN(h,block_w*(mb_y+1)); y++){
                 for(x=0; x<w; x++){
                     int v= buf[x + y*w] + (128<<FRAC_BITS) + (1<<(FRAC_BITS-1));
                     v >>= FRAC_BITS;
@@ -2835,7 +2835,7 @@ static always_inline void predict_slice(SnowContext *s, DWTELEM *buf, int plane_
                 }
             }
         }else{
-            for(y=block_w*mb_y; y<block_w*(mb_y+1); y++){
+            for(y=block_w*mb_y; y<FFMIN(h,block_w*(mb_y+1)); y++){
                 for(x=0; x<w; x++){
                     buf[x + y*w]-= 128<<FRAC_BITS;
                 }