diff options
| author | Michael Roitzsch <mroi@users.sourceforge.net> | 2004-07-19 17:12:48 +0000 |
|---|---|---|
| committer | Michael Roitzsch <mroi@users.sourceforge.net> | 2004-07-19 17:12:48 +0000 |
| commit | c4f358fba58af816d1d75e9fd916dfab24beff4c (patch) | |
| tree | a709e6b28d103e9aa39dab553a46a4b41e2c658d | |
| parent | d02b3aca9a61c734fbc201e7143b4f42dc50682f (diff) | |
| download | xine-lib-c4f358fba58af816d1d75e9fd916dfab24beff4c.tar.gz xine-lib-c4f358fba58af816d1d75e9fd916dfab24beff4c.tar.bz2 | |
we don't do any bounds checking when converting the SPU to a xine overlay,
therefore we tried to allocate for the worst case; unfortunately the worst
case was wrong
CVS patchset: 6814
CVS date: 2004/07/19 17:12:48
| -rw-r--r-- | src/libspudec/spu.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/src/libspudec/spu.c b/src/libspudec/spu.c index 336837737..1115ea6a7 100644 --- a/src/libspudec/spu.c +++ b/src/libspudec/spu.c @@ -36,7 +36,7 @@ * along with this program; see the file COPYING. If not, write to * the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA. * - * $Id: spu.c,v 1.77 2004/07/14 01:18:48 miguelfreitas Exp $ + * $Id: spu.c,v 1.78 2004/07/19 17:12:48 mroi Exp $ * */ @@ -793,8 +793,12 @@ static void spudec_draw_picture (xine_t *xine, spudec_state_t *state, spudec_seq * ovl->clip_right = ovl->width - 1; */ - - ovl->data_size = seq->cmd_offs * 2 * sizeof(rle_elem_t); + /* allocate for the worst case: + * - both fields running to the very end + * - 2 RLE elements per byte meaning single pixel RLE + */ + ovl->data_size = ((seq->cmd_offs - state->field_offs[0]) + + (seq->cmd_offs - state->field_offs[1])) * 2 * sizeof(rle_elem_t); if (ovl->rle) { xprintf (xine, XINE_VERBOSITY_DEBUG, |