lagarith: Fix out of array reads.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 5 insertions, 4 deletions

diff --git a/libavcodec/lagarith.c b/libavcodec/lagarith.c
index ef4799c153..c72de2dcfa 100644
--- a/libavcodec/lagarith.c
+++ b/libavcodec/lagarith.c
@@ -247,14 +247,15 @@ static void lag_pred_line(LagarithContext *l, uint8_t *buf,
 {
     int L, TL;
 
-    /* Left pixel is actually prev_row[width] */
-    L = buf[width - stride - 1];
     if (!line) {
         /* Left prediction only for first line */
         L = l->dsp.add_hfyu_left_prediction(buf + 1, buf + 1,
                                             width - 1, buf[0]);
         return;
-    } else if (line == 1) {
+    }
+    /* Left pixel is actually prev_row[width] */
+    L = buf[width - stride - 1];
+    if (line == 1) {
         /* Second line, left predict first pixel, the rest of the line is median predicted
          * NOTE: In the case of RGB this pixel is top predicted */
         TL = l->avctx->pix_fmt == PIX_FMT_YUV420P ? buf[-stride] : L;
@@ -498,7 +499,7 @@ static int lag_decode_frame(AVCodecContext *avctx,
 
         if (!l->rgb_planes) {
             l->rgb_stride = FFALIGN(avctx->width, 16);
-            l->rgb_planes = av_malloc(l->rgb_stride * avctx->height * planes);
+            l->rgb_planes = av_malloc(l->rgb_stride * avctx->height * planes + 16);
             if (!l->rgb_planes) {
                 av_log(avctx, AV_LOG_ERROR, "cannot allocate temporary buffer\n");
                 return AVERROR(ENOMEM);