Fix a potential out of array writing.

Patch by Mathieu Malaterre mathieu malaterre gmail com

Originally committed as revision 14487 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavcodec/rle.c b/libavcodec/rle.c
index 802f7f3..6e468f8 100644 (file)
--- a/libavcodec/rle.c
+++ b/libavcodec/rle.c
@@ -70,9 +70,9 @@ int ff_rle_encode(uint8_t *outbuf, int out_size, const uint8_t *ptr , int bpp, i
         } else {
             /* fall back on uncompressed */
             count = count_pixels(ptr, w-x, bpp, 0);
+            if(out + bpp*count >= outbuf + out_size) return -1;
             *out++ = (count ^ xor_raw) + add_raw;
 
-            if(out + bpp*count > outbuf + out_size) return -1;
             memcpy(out, ptr, bpp * count);
             out += bpp * count;
         }