[FFmpeg-devel] [PATCH] lagarith: Fix out of array reads.

[Michael Niedermayer]

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
---
 libavcodec/lagarith.c |    9 +++++----
 1 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/libavcodec/lagarith.c b/libavcodec/lagarith.c
index ef4799c..c72de2d 100644
--- a/libavcodec/lagarith.c
+++ b/libavcodec/lagarith.c
@@ -247,14 +247,15 @@ static void lag_pred_line(LagarithContext *l, uint8_t *buf,
 {
     int L, TL;
 
-    /* Left pixel is actually prev_row[width] */
-    L = buf[width - stride - 1];
     if (!line) {
         /* Left prediction only for first line */
         L = l->dsp.add_hfyu_left_prediction(buf + 1, buf + 1,
                                             width - 1, buf[0]);
         return;
-    } else if (line == 1) {
+    }
+    /* Left pixel is actually prev_row[width] */
+    L = buf[width - stride - 1];
+    if (line == 1) {
         /* Second line, left predict first pixel, the rest of the line is median predicted
          * NOTE: In the case of RGB this pixel is top predicted */
         TL = l->avctx->pix_fmt == PIX_FMT_YUV420P ? buf[-stride] : L;
@@ -498,7 +499,7 @@ static int lag_decode_frame(AVCodecContext *avctx,
 
         if (!l->rgb_planes) {
             l->rgb_stride = FFALIGN(avctx->width, 16);
-            l->rgb_planes = av_malloc(l->rgb_stride * avctx->height * planes);
+            l->rgb_planes = av_malloc(l->rgb_stride * avctx->height * planes + 16);
             if (!l->rgb_planes) {
                 av_log(avctx, AV_LOG_ERROR, "cannot allocate temporary buffer\n");
                 return AVERROR(ENOMEM);
-- 
1.7.5.4