From 7d65e960c72f36b73ae7fe84f8e427d758e61da9 Mon Sep 17 00:00:00 2001 From: Luca Barbato Date: Sat, 29 Jun 2013 07:26:48 +0200 Subject: iff: Do not read over the source buffer Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org --- libavcodec/iff.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'libavcodec/iff.c') diff --git a/libavcodec/iff.c b/libavcodec/iff.c index eda42e9c4c..bc878c50e3 100644 --- a/libavcodec/iff.c +++ b/libavcodec/iff.c @@ -289,7 +289,7 @@ static int decode_frame_ilbm(AVCodecContext *avctx, } } } else if (avctx->pix_fmt == AV_PIX_FMT_PAL8 || avctx->pix_fmt == AV_PIX_FMT_GRAY8) { // IFF-PBM - for (y = 0; y < avctx->height; y++) { + for (y = 0; y < avctx->height && buf < buf_end; y++) { uint8_t *row = &s->frame.data[0][y * s->frame.linesize[0]]; memcpy(row, buf, FFMIN(avctx->width, buf_end - buf)); buf += avctx->width + (avctx->width % 2); // padding if odd -- cgit v1.2.3