diff options
| author | Paul B Mahol <onemda@gmail.com> | 2017-02-27 14:15:11 +0100 |
|---|---|---|
| committer | Paul B Mahol <onemda@gmail.com> | 2017-02-27 14:17:51 +0100 |
| commit | 26a7d6a301b9b6c67153c87d42db145cdc0e57cf (patch) | |
| tree | 57dd630e26dccab92d749504808227ce42c44828 /libavcodec | |
| parent | 86ab6b6e08e2982fb5785e0691c0a7e289339ffb (diff) | |
| download | ffmpeg-26a7d6a301b9b6c67153c87d42db145cdc0e57cf.tar.gz | |
avcodec/qdrw: check bytes per scanline for 2bpp images
One byte less is read in case of small width.
Closes #6194.
Signed-off-by: Paul B Mahol <onemda@gmail.com>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/qdrw.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/qdrw.c b/libavcodec/qdrw.c index 20e673a515..c92cd85f12 100644 --- a/libavcodec/qdrw.c +++ b/libavcodec/qdrw.c @@ -81,7 +81,10 @@ static int decode_rle_bpp2(AVCodecContext *avctx, AVFrame *p, GetByteContext *gb int pos = 0; /* size of packed line */ - size = left = bytestream2_get_be16(gbc); + if (offset / 4 > 200) + size = left = bytestream2_get_be16(gbc); + else + size = left = bytestream2_get_byte(gbc); if (bytestream2_get_bytes_left(gbc) < size) return AVERROR_INVALIDDATA; |