From 26a7d6a301b9b6c67153c87d42db145cdc0e57cf Mon Sep 17 00:00:00 2001 From: Paul B Mahol Date: Mon, 27 Feb 2017 14:15:11 +0100 Subject: avcodec/qdrw: check bytes per scanline for 2bpp images One byte less is read in case of small width. Closes #6194. Signed-off-by: Paul B Mahol --- libavcodec/qdrw.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavcodec/qdrw.c b/libavcodec/qdrw.c index 20e673a515..c92cd85f12 100644 --- a/libavcodec/qdrw.c +++ b/libavcodec/qdrw.c @@ -81,7 +81,10 @@ static int decode_rle_bpp2(AVCodecContext *avctx, AVFrame *p, GetByteContext *gb int pos = 0; /* size of packed line */ - size = left = bytestream2_get_be16(gbc); + if (offset / 4 > 200) + size = left = bytestream2_get_be16(gbc); + else + size = left = bytestream2_get_byte(gbc); if (bytestream2_get_bytes_left(gbc) < size) return AVERROR_INVALIDDATA; -- cgit v1.2.3