[FFmpeg-cvslog] rv34: Fix potential overreads

[Laurent Aimar]

ffmpeg | branch: release/0.8 | Laurent Aimar <fenrir at videolan.org> | Sat Sep 17 16:56:30 2011 +0200| [a01387bb3524846d925a8862f077be91deb5f42d] | committer: Anton Khirnov

rv34: Fix potential overreads

Signed-off-by: Martin Storsjö <martin at martin.st>
(cherry picked from commit b4ed3d78cb6c41c9d3ee5918c326ab925edd6a89)

Signed-off-by: Anton Khirnov <anton at khirnov.net>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a01387bb3524846d925a8862f077be91deb5f42d
---

 libavcodec/rv34.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/libavcodec/rv34.c b/libavcodec/rv34.c
index 2383903..87fca5c 100644
--- a/libavcodec/rv34.c
+++ b/libavcodec/rv34.c
@@ -1436,6 +1436,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
         slice_count = (*buf++) + 1;
         slices_hdr = buf + 4;
         buf += 8 * slice_count;
+        buf_size -= 1 + 8 * slice_count;
     }else
         slice_count = avctx->slice_count;
 
@@ -1454,7 +1455,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
     if(   (avctx->skip_frame >= AVDISCARD_NONREF && si.type==AV_PICTURE_TYPE_B)
        || (avctx->skip_frame >= AVDISCARD_NONKEY && si.type!=AV_PICTURE_TYPE_I)
        ||  avctx->skip_frame >= AVDISCARD_ALL)
-        return buf_size;
+        return avpkt->size;
 
     for(i=0; i<slice_count; i++){
         int offset= get_slice_offset(avctx, slices_hdr, i);
@@ -1503,7 +1504,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
         }
         s->current_picture_ptr= NULL; //so we can detect if frame_end wasnt called (find some nicer solution...)
     }
-    return buf_size;
+    return avpkt->size;
 }
 
 av_cold int ff_rv34_decode_end(AVCodecContext *avctx)