diff options
Diffstat (limited to 'libavcodec/8bps.c')
| -rw-r--r-- | libavcodec/8bps.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/8bps.c b/libavcodec/8bps.c index 3898ac5dd3..4d5a64e5d9 100644 --- a/libavcodec/8bps.c +++ b/libavcodec/8bps.c @@ -100,11 +100,13 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, uint8 dlen = be2me_16(*(unsigned short *)(lp+row*2)); /* Decode a row of this plane */ while(dlen > 0) { + if(dp + 1 >= buf+buf_size) return -1; if ((count = *dp++) <= 127) { count++; dlen -= count + 1; if (pixptr + count * px_inc > pixptr_end) break; + if(dp + count > buf+buf_size) return -1; while(count--) { *pixptr = *dp++; pixptr += px_inc; |