lavc/qdrw: Fix overwrite when reading invalid Quickdraw images.
authorCarl Eugen Hoyos <cehoyos@ag.or.at>
Sat, 16 May 2015 20:51:16 +0000 (22:51 +0200)
committerCarl Eugen Hoyos <cehoyos@ag.or.at>
Sun, 17 May 2015 00:08:58 +0000 (02:08 +0200)
libavcodec/qdrw.c

index 6c920aa..0bcf5dc 100644 (file)
@@ -95,6 +95,8 @@ static int decode_rle(AVCodecContext *avctx, AVFrame *p, GetByteContext *gbc,
                         pos -= offset;
                         pos++;
                     }
+                    if (pos >= offset)
+                        return AVERROR_INVALIDDATA;
                 }
                 left  -= 2;
             } else { /* copy */
@@ -105,6 +107,8 @@ static int decode_rle(AVCodecContext *avctx, AVFrame *p, GetByteContext *gbc,
                         pos -= offset;
                         pos++;
                     }
+                    if (pos >= offset)
+                        return AVERROR_INVALIDDATA;
                 }
                 left  -= 2 + code;
             }