rpza: Fix a buffer size check
authorMartin Storsjö <martin@martin.st>
Sat, 28 Sep 2013 22:24:20 +0000 (01:24 +0300)
committerLuca Barbato <lu_zero@gentoo.org>
Fri, 4 Oct 2013 01:52:11 +0000 (03:52 +0200)
We read 2 bytes for 15 out of 16 pixels, therefore we need to
have at least 30 bytes, not 16.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 7ba0cedbfeff5671b264d1d7e90777057b5714c6)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
libavcodec/rpza.c

index 57d4d2d..59b15c6 100644 (file)
@@ -203,7 +203,7 @@ static void rpza_decode_stream(RpzaContext *s)
 
         /* Fill block with 16 colors */
         case 0x00:
-            if (s->size - stream_ptr < 16)
+            if (s->size - stream_ptr < 30)
                 return;
             block_ptr = row_ptr + pixel_ptr;
             for (pixel_y = 0; pixel_y < 4; pixel_y++) {