diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-03 03:37:52 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-03-03 03:37:52 +0100 |
| commit | 4299dfa5ded84111231a456ad102f65f6f62649e (patch) | |
| tree | 76d075efd7fac7fce2893f157d00bf307517ef53 /libavcodec/qpeg.c | |
| parent | aaa1173de775b9b865a714abcc270816d2f59dff (diff) | |
qpeg: Fix out of array writes.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/qpeg.c')
| -rw-r--r-- | libavcodec/qpeg.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/qpeg.c b/libavcodec/qpeg.c index ca48b6bcf3..f2dba732bc 100644 --- a/libavcodec/qpeg.c +++ b/libavcodec/qpeg.c @@ -203,6 +203,8 @@ static void qpeg_decode_inter(const uint8_t *src, uint8_t *dst, int size, filled = 0; dst -= stride; height--; + if(height < 0) + break; } } } else if(code >= 0xC0) { /* copy code: 0xC0..0xDF */ @@ -214,6 +216,8 @@ static void qpeg_decode_inter(const uint8_t *src, uint8_t *dst, int size, filled = 0; dst -= stride; height--; + if(height < 0) + break; } } size -= code + 1; |