> For example in convM2D() it sets ebuf as:
> ebuf = buf + nbuf;
> 
> and then checks if reads will go past ebuf. But ebuf will point to the
> first byte after the buffer, so past ebuf will include the byte after
> the buffer. So it can potentially try to read of write to one byte
> past the buffer in all these functions.

it would if it tries to access that byte but it doesn't in convM2D.c or 
convD2M.c
it's checking that the resulting pointer after accessing the bytes will still 
be <= ebuf,
which (i think) is correct.

Reply via email to