Xiaohui Sun wrote: >> this code still lacks checks against buffer overflows > > I find nowhere to get the out_buf size, I think it is linesize * s->height. That is usually how we do it. -- -Mike Melanson