offset = *src++;
size = opcode & 3;
- if (dest + size > dest_end)
+ if (size > dest_end - dest)
return;
memcpy(dest, src, size); dest += size; src += size;
size = ((opcode & 0x1c) >> 2) + 3;
- if (dest + size > dest_end)
+ if (size > dest_end - dest)
return;
av_memcpy_backptr(dest, ((opcode & 0x60) << 3) + offset + 1, size);
dest += size;
byte2 = *src++;
size = byte1 >> 6;
- if (dest + size > dest_end)
+ if (size > dest_end - dest)
return;
memcpy(dest, src, size); dest += size; src += size;
size = (opcode & 0x3f) + 4;
- if (dest + size > dest_end)
+ if (size > dest_end - dest)
return;
av_memcpy_backptr(dest, ((byte1 & 0x3f) << 8) + byte2 + 1, size);
dest += size;
byte3 = *src++;
size = opcode & 3;
- if (dest + size > dest_end)
+ if (size > dest_end - dest)
return;
memcpy(dest, src, size); dest += size; src += size;
size = byte3 + 5 + ((opcode & 0xc) << 6);
- if (dest + size > dest_end)
+ if (size > dest_end - dest)
return;
av_memcpy_backptr(dest,
((opcode & 0x10) << 12) + 1 + (byte1 << 8) + byte2,
if (size > 0x70)
break;
- if (dest + size > dest_end)
+ if (size > dest_end - dest)
return;
memcpy(dest, src, size); dest += size; src += size;
}