qtrle: check for invalid line offset
authorLaurent Aimar <fenrir@videolan.org>
Sat, 8 Oct 2011 21:01:33 +0000 (23:01 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sun, 6 Nov 2011 18:49:12 +0000 (19:49 +0100)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a4ed7c3fe9f99b89f86b65710d8855dc572f1a25)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 67c46b9b3027fdd9fd737e21a80d3326748b1c15)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/qtrle.c

index d535c38..b66acd4 100644 (file)
@@ -461,6 +461,8 @@ static int qtrle_decode_frame(AVCodecContext *avctx,
         stream_ptr += 4;
         height = AV_RB16(&s->buf[stream_ptr]);
         stream_ptr += 4;
+        if (height > s->avctx->height - start_line)
+            goto done;
     } else {
         start_line = 0;
         height = s->avctx->height;