diff options
| author | Martin Storsjö <martin@martin.st> | 2013-09-29 01:24:20 +0300 |
|---|---|---|
| committer | Martin Storsjö <martin@martin.st> | 2013-09-29 20:02:42 +0300 |
| commit | 7ba0cedbfeff5671b264d1d7e90777057b5714c6 (patch) | |
| tree | c0c2c9aeffae4dcbac40e42fc5bf3a01e4ae0089 | |
| parent | aa0dd52434768da64f1f3d8ae92bcf980c1adffc (diff) | |
| download | ffmpeg-7ba0cedbfeff5671b264d1d7e90777057b5714c6.tar.gz | |
rpza: Fix a buffer size check
We read 2 bytes for 15 out of 16 pixels, therefore we need to
have at least 30 bytes, not 16.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
| -rw-r--r-- | libavcodec/rpza.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/rpza.c b/libavcodec/rpza.c index 45350a85d8..ca9f7ea336 100644 --- a/libavcodec/rpza.c +++ b/libavcodec/rpza.c @@ -204,7 +204,7 @@ static void rpza_decode_stream(RpzaContext *s) /* Fill block with 16 colors */ case 0x00: - if (s->size - stream_ptr < 16) + if (s->size - stream_ptr < 30) return; block_ptr = row_ptr + pixel_ptr; for (pixel_y = 0; pixel_y < 4; pixel_y++) { |