diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-10-08 23:01:33 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-11-04 01:01:07 +0100 |
| commit | 67c46b9b3027fdd9fd737e21a80d3326748b1c15 (patch) | |
| tree | 8e6401755b953c7c89799812eb8ad99be3870341 /libavcodec | |
| parent | 7ab0b6b7eda60e235b7db07a6895fa8bdade01c8 (diff) | |
| download | ffmpeg-67c46b9b3027fdd9fd737e21a80d3326748b1c15.tar.gz | |
qtrle: check for invalid line offset
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a4ed7c3fe9f99b89f86b65710d8855dc572f1a25)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/qtrle.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/qtrle.c b/libavcodec/qtrle.c index 2cc2de2e23..0f280f5829 100644 --- a/libavcodec/qtrle.c +++ b/libavcodec/qtrle.c @@ -464,6 +464,8 @@ static int qtrle_decode_frame(AVCodecContext *avctx, stream_ptr += 4; height = AV_RB16(&s->buf[stream_ptr]); stream_ptr += 4; + if (height > s->avctx->height - start_line) + goto done; } else { start_line = 0; height = s->avctx->height; |