diff options
| author | Luca Barbato <lu_zero@gentoo.org> | 2013-06-29 07:26:48 +0200 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2013-07-10 15:24:42 +0200 |
| commit | 7d65e960c72f36b73ae7fe84f8e427d758e61da9 (patch) | |
| tree | f21481ac4859f4154e72c73b485a187628364f4a | |
| parent | 3865ba7b21aef5d60183719e238361ec8797ab5a (diff) | |
| download | ffmpeg-7d65e960c72f36b73ae7fe84f8e427d758e61da9.tar.gz | |
iff: Do not read over the source buffer
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
| -rw-r--r-- | libavcodec/iff.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/iff.c b/libavcodec/iff.c index eda42e9c4c..bc878c50e3 100644 --- a/libavcodec/iff.c +++ b/libavcodec/iff.c @@ -289,7 +289,7 @@ static int decode_frame_ilbm(AVCodecContext *avctx, } } } else if (avctx->pix_fmt == AV_PIX_FMT_PAL8 || avctx->pix_fmt == AV_PIX_FMT_GRAY8) { // IFF-PBM - for (y = 0; y < avctx->height; y++) { + for (y = 0; y < avctx->height && buf < buf_end; y++) { uint8_t *row = &s->frame.data[0][y * s->frame.linesize[0]]; memcpy(row, buf, FFMIN(avctx->width, buf_end - buf)); buf += avctx->width + (avctx->width % 2); // padding if odd |