[FFmpeg-cvslog] iff: fix invalid reads (ticket 689)

[Peter Ross]

ffmpeg | branch: master | Peter Ross <pross at xvid.org> | Sun Nov 27 12:07:47 2011 +1100| [b4886795108e319a5b3a88370e90207d9c15a01e] | committer: Michael Niedermayer

iff: fix invalid reads (ticket 689)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b4886795108e319a5b3a88370e90207d9c15a01e
---

 libavcodec/iff.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/iff.c b/libavcodec/iff.c
index c4c614e..30a3f6f 100644
--- a/libavcodec/iff.c
+++ b/libavcodec/iff.c
@@ -464,7 +464,7 @@ static int decode_frame_ilbm(AVCodecContext *avctx,
         } else if (s->ham) { // HAM to PIX_FMT_BGR32
             for (y = 0; y < avctx->height; y++) {
                 uint8_t *row = &s->frame.data[0][ y*s->frame.linesize[0] ];
-                memset(s->ham_buf, 0, avctx->width);
+                memset(s->ham_buf, 0, s->planesize * 8);
                 for (plane = 0; plane < s->bpp && buf < buf_end; plane++) {
                     decodeplane8(s->ham_buf, buf, FFMIN(s->planesize, buf_end - buf), plane);
                     buf += s->planesize;
@@ -540,7 +540,7 @@ static int decode_frame_byterun1(AVCodecContext *avctx,
         } else if (s->ham) { // HAM to PIX_FMT_BGR32
             for (y = 0; y < avctx->height ; y++) {
                 uint8_t *row = &s->frame.data[0][y*s->frame.linesize[0]];
-                memset(s->ham_buf, 0, avctx->width);
+                memset(s->ham_buf, 0, s->planesize * 8);
                 for (plane = 0; plane < s->bpp; plane++) {
                     buf += decode_byterun(s->planebuf, s->planesize, buf, buf_end);
                     decodeplane8(s->ham_buf, s->planebuf, s->planesize, plane);