avcodec/qdrw: check bytes per scanline for 2bpp images
authorPaul B Mahol <onemda@gmail.com>
Mon, 27 Feb 2017 13:15:11 +0000 (14:15 +0100)
committerPaul B Mahol <onemda@gmail.com>
Mon, 27 Feb 2017 13:17:51 +0000 (14:17 +0100)
One byte less is read in case of small width.
Closes #6194.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
libavcodec/qdrw.c

index 20e673a..c92cd85 100644 (file)
@@ -81,7 +81,10 @@ static int decode_rle_bpp2(AVCodecContext *avctx, AVFrame *p, GetByteContext *gb
         int pos = 0;
 
         /* size of packed line */
-        size = left = bytestream2_get_be16(gbc);
+        if (offset / 4 > 200)
+            size = left = bytestream2_get_be16(gbc);
+        else
+            size = left = bytestream2_get_byte(gbc);
         if (bytestream2_get_bytes_left(gbc) < size)
             return AVERROR_INVALIDDATA;