diff options
| author | Martin Storsjö <martin@martin.st> | 2013-09-19 15:53:31 +0300 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2013-10-04 03:26:28 +0200 |
| commit | 4d90550cf95eac0451465116d6e53bac37b96927 (patch) | |
| tree | 47dbc46bc09c08467fb4f5a489f7df9edd518cf2 | |
| parent | bacf5db1962a6955ce80eea6bbc86c6970d7d360 (diff) | |
| download | ffmpeg-4d90550cf95eac0451465116d6e53bac37b96927.tar.gz | |
qpeg: Add checks for running out of rows in qpeg_decode_inter
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 7a5a55722749a3ab77941914707277b147322cbe)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
| -rw-r--r-- | libavcodec/qpeg.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/qpeg.c b/libavcodec/qpeg.c index 4a918e71ec..75e12234fe 100644 --- a/libavcodec/qpeg.c +++ b/libavcodec/qpeg.c @@ -190,6 +190,8 @@ static void qpeg_decode_inter(QpegContext *qctx, uint8_t *dst, filled = 0; dst -= stride; height--; + if (height < 0) + break; } } } else if(code >= 0xC0) { /* copy code: 0xC0..0xDF */ @@ -201,6 +203,8 @@ static void qpeg_decode_inter(QpegContext *qctx, uint8_t *dst, filled = 0; dst -= stride; height--; + if (height < 0) + break; } } } else if(code >= 0x80) { /* skip code: 0x80..0xBF */ |