avcodec/qdrw: fix decoding of odd sized images for 8bpp
authorPaul B Mahol <onemda@gmail.com>
Mon, 27 Feb 2017 10:49:59 +0000 (11:49 +0100)
committerPaul B Mahol <onemda@gmail.com>
Mon, 27 Feb 2017 10:49:59 +0000 (11:49 +0100)
Signed-off-by: Paul B Mahol <onemda@gmail.com>
libavcodec/qdrw.c

index 11a0675..975e440 100644 (file)
@@ -231,26 +231,24 @@ static int decode_rle(AVCodecContext *avctx, AVFrame *p, GetByteContext *gbc,
             if (code & 0x80 ) { /* run */
                 pix = bytestream2_get_byte(gbc);
                 for (j = 0; j < 257 - code; j++) {
-                    out[pos] = pix;
+                    if (pos < offset)
+                        out[pos] = pix;
                     pos += step;
-                    if (pos >= offset) {
+                    if (pos >= offset && step > 1) {
                         pos -= offset;
                         pos++;
                     }
-                    if (pos >= offset)
-                        return AVERROR_INVALIDDATA;
                 }
                 left  -= 2;
             } else { /* copy */
                 for (j = 0; j < code + 1; j++) {
-                    out[pos] = bytestream2_get_byte(gbc);
+                    if (pos < offset)
+                        out[pos] = bytestream2_get_byte(gbc);
                     pos += step;
-                    if (pos >= offset) {
+                    if (pos >= offset && step > 1) {
                         pos -= offset;
                         pos++;
                     }
-                    if (pos >= offset)
-                        return AVERROR_INVALIDDATA;
                 }
                 left  -= 2 + code;
             }