From fd7af82c53ea8a2577ea8952d35fb158db594592 Mon Sep 17 00:00:00 2001 From: Paul B Mahol Date: Thu, 23 Feb 2017 17:22:01 +0100 Subject: [PATCH] avcodec/scpr: do not allow out of array access for 16bit case Signed-off-by: Paul B Mahol --- libavcodec/scpr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/scpr.c b/libavcodec/scpr.c index f53f1d4039..73e7eedb77 100644 --- a/libavcodec/scpr.c +++ b/libavcodec/scpr.c @@ -408,7 +408,7 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize) } if (avctx->bits_per_coded_sample == 16) { - cx1 = (clr & 0xFF00) >> 2; + cx1 = (clr & 0x3F00) >> 2; cx = (clr & 0xFFFFFF) >> 16; } else { cx1 = (clr & 0xFC00) >> 4; @@ -647,7 +647,7 @@ static int decompress_p(AVCodecContext *avctx, } if (avctx->bits_per_coded_sample == 16) { - cx1 = (clr & 0xFF00) >> 2; + cx1 = (clr & 0x3F00) >> 2; cx = (clr & 0xFFFFFF) >> 16; } else { cx1 = (clr & 0xFC00) >> 4;