Fix memcpy out-of-bounds.

patch by Michel Bardiaux, mbardiaux mediaxim be

Originally committed as revision 7780 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavcodec/bmp.c b/libavcodec/bmp.c
index 20cca16..30eee65 100644 (file)
--- a/libavcodec/bmp.c
+++ b/libavcodec/bmp.c
@@ -187,7 +187,7 @@ static int bmp_decode_frame(AVCodecContext *avctx,
     switch(depth){
     case 24:
         for(i = 0; i < avctx->height; i++){
-            memcpy(ptr, buf, n);
+            memcpy(ptr, buf, avctx->width*(depth>>3));
             buf += n;
             ptr += linesize;
         }