Merge commit 'd1d99e3befea5d411ac3aae72dbdecce94f8b547'
authorMichael Niedermayer <michaelni@gmx.at>
Sun, 29 Sep 2013 23:46:54 +0000 (01:46 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sun, 29 Sep 2013 23:49:21 +0000 (01:49 +0200)
* commit 'd1d99e3befea5d411ac3aae72dbdecce94f8b547':
  pcx: Check the packet size before assuming it fits a palette

Merged-by: Michael Niedermayer <michaelni@gmx.at>
1  2 
libavcodec/pcx.c

@@@ -161,10 -167,17 +161,16 @@@ static int pcx_decode_frame(AVCodecCont
              ptr += stride;
          }
      } else if (nplanes == 1 && bits_per_pixel == 8) {
 -        const uint8_t *palstart = bufstart + buf_size - 769;
 +        int palstart = avpkt->size - 769;
  
 -        if (buf_size < 769) {
++        if (avpkt->size < 769) {
+             av_log(avctx, AV_LOG_ERROR, "File is too short\n");
 -            ret = buf_size;
++            ret = avpkt->size;
+             goto end;
+         }
          for (y = 0; y < h; y++, ptr += stride) {
 -            buf = pcx_rle_decode(buf, buf_end,
 -                                 scanline, bytes_per_scanline, compressed);
 +            pcx_rle_decode(&gb, scanline, bytes_per_scanline, compressed);
              memcpy(ptr, scanline, w);
          }