X-Git-Url: http://git.asbjorn.biz/?a=blobdiff_plain;f=lib%2Fmodules%2Fswfbits.c;h=4fa38f55c0eb1d5904e16f061a35a546e3c09fe7;hb=1f86ebaac605b62901bd103b1f23b53979acc5a4;hp=4f6b3101c799133fd90d58e2c44490f212100213;hpb=c53aa61d2d061e0fa15f6c8a4fe945766a2733d1;p=swftools.git

diff --git a/lib/modules/swfbits.c b/lib/modules/swfbits.c
index 4f6b310..4fa38f5 100644
--- a/lib/modules/swfbits.c
+++ b/lib/modules/swfbits.c
@@ -561,7 +561,8 @@ static void tag_init_source(struct jpeg_decompress_struct *cinfo)
 static boolean tag_fill_input_buffer(struct jpeg_decompress_struct *cinfo)
 {
     TAG *tag = (TAG *) cinfo->client_data;
-    if (tag->data[tag->pos + 0] == 0xff &&
+    if (tag->pos + 4 <= tag->len &&
+	tag->data[tag->pos + 0] == 0xff &&
 	tag->data[tag->pos + 1] == 0xd9 &&
 	tag->data[tag->pos + 2] == 0xff &&
 	tag->data[tag->pos + 3] == 0xd8) {
@@ -1399,12 +1400,12 @@ static void blurImage(RGBA*src, int width, int height, int r)
     }
     int range = r*e/2;
 
-    RGBA*dest = malloc(sizeof(RGBA)*width*height);
+    RGBA*tmp = malloc(sizeof(RGBA)*width*height);
 
     int y;
     for(y=0;y<height;y++) {
         RGBA*s = &src[y*width];
-        RGBA*d = &dest[y*width];
+        RGBA*d = &tmp[y*width];
         for(x=0;x<range;x++) {
             d[x] = s[x];
         }
@@ -1432,11 +1433,9 @@ static void blurImage(RGBA*src, int width, int height, int r)
         }
     }
 
-    memcpy(src, dest, width*height*sizeof(RGBA));
-
     for(x=0;x<width;x++) {
-        RGBA*s = &src[x];
-        RGBA*d = &dest[x];
+        RGBA*s = &tmp[x];
+        RGBA*d = &src[x];
         int yy=0;
         for(y=0;y<range;y++) {
             d[yy] = s[yy];
@@ -1468,9 +1467,8 @@ static void blurImage(RGBA*src, int width, int height, int r)
             yy += width;
         }
     }
-    memcpy(src, dest, width*height*sizeof(RGBA));
 
-    free(dest);
+    free(tmp);
     free(weights);
     free(gauss);
 }