diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-10-08 23:01:33 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-11-06 19:49:12 +0100 |
| commit | e1a46eff7a1017e1d3afc5204b82e08a1ea0bf3d (patch) | |
| tree | a0c0366251846b5451ffedc623e19c067267eade /libavcodec | |
| parent | 23aaa82b1d30456339c09b3591fe78534839d4d0 (diff) | |
| download | ffmpeg-e1a46eff7a1017e1d3afc5204b82e08a1ea0bf3d.tar.gz | |
qtrle: check for invalid line offset
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a4ed7c3fe9f99b89f86b65710d8855dc572f1a25)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 67c46b9b3027fdd9fd737e21a80d3326748b1c15)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/qtrle.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/qtrle.c b/libavcodec/qtrle.c index d535c38dd9..b66acd4220 100644 --- a/libavcodec/qtrle.c +++ b/libavcodec/qtrle.c @@ -461,6 +461,8 @@ static int qtrle_decode_frame(AVCodecContext *avctx, stream_ptr += 4; height = AV_RB16(&s->buf[stream_ptr]); stream_ptr += 4; + if (height > s->avctx->height - start_line) + goto done; } else { start_line = 0; height = s->avctx->height; |