rawdec: fix input overread.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 2 insertions, 2 deletions

diff --git a/libavcodec/rawdec.c b/libavcodec/rawdec.c
index 68b461d2f1..d912ca285d 100644
--- a/libavcodec/rawdec.c
+++ b/libavcodec/rawdec.c
@@ -161,13 +161,13 @@ static int raw_decode(AVCodecContext *avctx,
         uint8_t *dst = context->buffer;
         buf_size = context->length - 256*4;
         if (avctx->bits_per_coded_sample == 4){
-            for(i=0; 2*i+1 < buf_size; i++){
+            for(i=0; 2*i+1 < buf_size && i<avpkt->size; i++){
                 dst[2*i+0]= buf[i]>>4;
                 dst[2*i+1]= buf[i]&15;
             }
             linesize_align = 8;
         } else {
-            for(i=0; 4*i+3 < buf_size; i++){
+            for(i=0; 4*i+3 < buf_size && i<avpkt->size; i++){
                 dst[4*i+0]= buf[i]>>6;
                 dst[4*i+1]= buf[i]>>4&3;
                 dst[4*i+2]= buf[i]>>2&3;