This only happens for a "back" value of 0 which is invalid anyway, but lcldec does not properly validate input. Also extend the documentation to specify valid values. Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>tags/n0.10
| @@ -112,7 +112,7 @@ static inline void memcpy_backptr(uint8_t *dst, int back, int cnt); | |||||
| /** | /** | ||||
| * @brief Copies previously decoded bytes to current position. | * @brief Copies previously decoded bytes to current position. | ||||
| * @param back how many bytes back we start | |||||
| * @param back how many bytes back we start, must be > 0 | |||||
| * @param cnt number of bytes to copy, must be >= 0 | * @param cnt number of bytes to copy, must be >= 0 | ||||
| * | * | ||||
| * cnt > back is valid, this will copy the bytes we just copied, | * cnt > back is valid, this will copy the bytes we just copied, | ||||
| @@ -135,9 +135,9 @@ static inline void copy_backptr(LZOContext *c, int back, int cnt) { | |||||
| static inline void memcpy_backptr(uint8_t *dst, int back, int cnt) { | static inline void memcpy_backptr(uint8_t *dst, int back, int cnt) { | ||||
| const uint8_t *src = &dst[-back]; | const uint8_t *src = &dst[-back]; | ||||
| if (back == 1) { | |||||
| if (back <= 1) { | |||||
| memset(dst, *src, cnt); | memset(dst, *src, cnt); | ||||
| } else if(back>0) { | |||||
| } else { | |||||
| #ifdef OUTBUF_PADDED | #ifdef OUTBUF_PADDED | ||||
| COPY2(dst, src); | COPY2(dst, src); | ||||
| COPY2(dst + 2, src + 2); | COPY2(dst + 2, src + 2); | ||||
| @@ -62,11 +62,14 @@ int av_lzo1x_decode(void *out, int *outlen, const void *in, int *inlen); | |||||
| /** | /** | ||||
| * @brief deliberately overlapping memcpy implementation | * @brief deliberately overlapping memcpy implementation | ||||
| * @param dst destination buffer; must be padded with 12 additional bytes | * @param dst destination buffer; must be padded with 12 additional bytes | ||||
| * @param back how many bytes back we start (the initial size of the overlapping window) | |||||
| * @param back how many bytes back we start (the initial size of the overlapping window), must be > 0 | |||||
| * @param cnt number of bytes to copy, must be >= 0 | * @param cnt number of bytes to copy, must be >= 0 | ||||
| * | * | ||||
| * cnt > back is valid, this will copy the bytes we just copied, | * cnt > back is valid, this will copy the bytes we just copied, | ||||
| * thus creating a repeating pattern with a period length of back. | * thus creating a repeating pattern with a period length of back. | ||||
| * Note that lcldec currently can set back == 0 - which is wrong and | |||||
| * makes no sense, but the code should at least avoid crashing or hanging | |||||
| * for this case. | |||||
| */ | */ | ||||
| void av_memcpy_backptr(uint8_t *dst, int back, int cnt); | void av_memcpy_backptr(uint8_t *dst, int back, int cnt); | ||||