From ee357d6991524f146dd1c36496395cedae0309be Mon Sep 17 00:00:00 2001 From: Paul B Mahol Date: Sat, 23 Sep 2023 01:04:51 +0200 Subject: [PATCH] avcodec/rasc: fix decoding with AVFrame's negative linesize --- libavcodec/rasc.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/libavcodec/rasc.c b/libavcodec/rasc.c index 4d057e80e7..21c1829fc7 100644 --- a/libavcodec/rasc.c +++ b/libavcodec/rasc.c @@ -379,8 +379,8 @@ static int decode_dlta(AVCodecContext *avctx, if (!s->frame2->data[0] || !s->frame1->data[0]) return AVERROR_INVALIDDATA; - b1 = s->frame1->data[0] + s->frame1->linesize[0] * (y + h - 1) + x * s->bpp; - b2 = s->frame2->data[0] + s->frame2->linesize[0] * (y + h - 1) + x * s->bpp; + b1 = s->frame1->data[0] + s->frame1->linesize[0] * (int)(y + h - 1) + ((int)x) * s->bpp; + b2 = s->frame2->data[0] + s->frame2->linesize[0] * (int)(y + h - 1) + ((int)x) * s->bpp; cx = 0, cy = h; while (bytestream2_get_bytes_left(&dc) > 0) { int type = bytestream2_get_byte(&dc); @@ -620,7 +620,7 @@ static void draw_cursor(AVCodecContext *avctx) if (cr == s->cursor[0] && cg == s->cursor[1] && cb == s->cursor[2]) continue; - dst = s->frame->data[0] + s->frame->linesize[0] * (s->cursor_y + i) + (s->cursor_x + j); + dst = s->frame->data[0] + s->frame->linesize[0] * (int)(s->cursor_y + i) + (int)(s->cursor_x + j); for (int k = 0; k < 256; k++) { int pr = pal[k * 4 + 0]; int pg = pal[k * 4 + 1]; @@ -646,7 +646,7 @@ static void draw_cursor(AVCodecContext *avctx) continue; cr >>= 3; cg >>=3; cb >>= 3; - dst = s->frame->data[0] + s->frame->linesize[0] * (s->cursor_y + i) + 2 * (s->cursor_x + j); + dst = s->frame->data[0] + s->frame->linesize[0] * (int)(s->cursor_y + i) + 2 * (s->cursor_x + j); AV_WL16(dst, cr | cg << 5 | cb << 10); } } @@ -660,7 +660,7 @@ static void draw_cursor(AVCodecContext *avctx) if (cr == s->cursor[0] && cg == s->cursor[1] && cb == s->cursor[2]) continue; - dst = s->frame->data[0] + s->frame->linesize[0] * (s->cursor_y + i) + 4 * (s->cursor_x + j); + dst = s->frame->data[0] + s->frame->linesize[0] * (int)(s->cursor_y + i) + 4 * (s->cursor_x + j); dst[0] = cb; dst[1] = cg; dst[2] = cr;