From c4f358fba58af816d1d75e9fd916dfab24beff4c Mon Sep 17 00:00:00 2001 From: Michael Roitzsch Date: Mon, 19 Jul 2004 17:12:48 +0000 Subject: we don't do any bounds checking when converting the SPU to a xine overlay, therefore we tried to allocate for the worst case; unfortunately the worst case was wrong CVS patchset: 6814 CVS date: 2004/07/19 17:12:48 --- src/libspudec/spu.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'src') diff --git a/src/libspudec/spu.c b/src/libspudec/spu.c index 336837737..1115ea6a7 100644 --- a/src/libspudec/spu.c +++ b/src/libspudec/spu.c @@ -36,7 +36,7 @@ * along with this program; see the file COPYING. If not, write to * the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA. * - * $Id: spu.c,v 1.77 2004/07/14 01:18:48 miguelfreitas Exp $ + * $Id: spu.c,v 1.78 2004/07/19 17:12:48 mroi Exp $ * */ @@ -793,8 +793,12 @@ static void spudec_draw_picture (xine_t *xine, spudec_state_t *state, spudec_seq * ovl->clip_right = ovl->width - 1; */ - - ovl->data_size = seq->cmd_offs * 2 * sizeof(rle_elem_t); + /* allocate for the worst case: + * - both fields running to the very end + * - 2 RLE elements per byte meaning single pixel RLE + */ + ovl->data_size = ((seq->cmd_offs - state->field_offs[0]) + + (seq->cmd_offs - state->field_offs[1])) * 2 * sizeof(rle_elem_t); if (ovl->rle) { xprintf (xine, XINE_VERBOSITY_DEBUG, -- cgit v1.2.3