avcodec/bmp_parser: Ensure remaining_size is not too small in startcode packet crossi...
authorMichael Niedermayer <michael@niedermayer.cc>
Thu, 14 Apr 2016 13:10:31 +0000 (15:10 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Thu, 14 Apr 2016 13:28:02 +0000 (15:28 +0200)
Fixes Ticket 5438

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/bmp_parser.c

index c9493dc..7ab32a0 100644 (file)
@@ -63,7 +63,7 @@ restart:
                     continue;
                 }
                 bpc->pc.frame_start_found++;
-                bpc->remaining_size = bpc->fsize + i - 17;
+                bpc->remaining_size = bpc->fsize + FFMAX(i - 17, 0);
 
                 if (bpc->pc.index + i > 17) {
                     next = i - 17;