qpeg: Add checks for running out of rows in qpeg_decode_inter
authorMartin Storsjö <martin@martin.st>
Thu, 19 Sep 2013 12:53:31 +0000 (15:53 +0300)
committerMartin Storsjö <martin@martin.st>
Thu, 19 Sep 2013 19:44:39 +0000 (22:44 +0300)
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
libavcodec/qpeg.c

index bb963ed..a3a5db5 100644 (file)
@@ -191,6 +191,8 @@ static void qpeg_decode_inter(QpegContext *qctx, uint8_t *dst,
                     filled = 0;
                     dst -= stride;
                     height--;
+                    if (height < 0)
+                        break;
                 }
             }
         } else if(code >= 0xC0) { /* copy code: 0xC0..0xDF */
@@ -202,6 +204,8 @@ static void qpeg_decode_inter(QpegContext *qctx, uint8_t *dst,
                     filled = 0;
                     dst -= stride;
                     height--;
+                    if (height < 0)
+                        break;
                 }
             }
         } else if(code >= 0x80) { /* skip code: 0x80..0xBF */