diff options
| author | Martin Storsjö <martin@martin.st> | 2013-09-19 15:53:31 +0300 |
|---|---|---|
| committer | Martin Storsjö <martin@martin.st> | 2013-09-19 22:44:39 +0300 |
| commit | 7a5a55722749a3ab77941914707277b147322cbe (patch) | |
| tree | 385a4f0790c4a44368bf283fca39a9ca4579311c /libavcodec/qpeg.c | |
| parent | e9d61de96c113ee0ef8082833c7e682df0e23eec (diff) | |
qpeg: Add checks for running out of rows in qpeg_decode_inter
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
Diffstat (limited to 'libavcodec/qpeg.c')
| -rw-r--r-- | libavcodec/qpeg.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/qpeg.c b/libavcodec/qpeg.c index bb963ed1a3..a3a5db5c10 100644 --- a/libavcodec/qpeg.c +++ b/libavcodec/qpeg.c @@ -191,6 +191,8 @@ static void qpeg_decode_inter(QpegContext *qctx, uint8_t *dst, filled = 0; dst -= stride; height--; + if (height < 0) + break; } } } else if(code >= 0xC0) { /* copy code: 0xC0..0xDF */ @@ -202,6 +204,8 @@ static void qpeg_decode_inter(QpegContext *qctx, uint8_t *dst, filled = 0; dst -= stride; height--; + if (height < 0) + break; } } } else if(code >= 0x80) { /* skip code: 0x80..0xBF */ |