diff options
| author | Peter Ross <pross@xvid.org> | 2011-12-01 19:17:16 +1100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-12-01 14:35:46 +0100 |
| commit | f3f488423a12af9bb4eed6e6868cfa86ece3571b (patch) | |
| tree | bf100322f6cdf30a7f6b5af326318ca374a23f34 /libavcodec/pictordec.c | |
| parent | 43a2a8b4a3d09ca22cb52796ec2c48a16c47cd8a (diff) | |
| download | android_external_ffmpeg-f3f488423a12af9bb4eed6e6868cfa86ece3571b.tar.gz android_external_ffmpeg-f3f488423a12af9bb4eed6e6868cfa86ece3571b.tar.bz2 android_external_ffmpeg-f3f488423a12af9bb4eed6e6868cfa86ece3571b.zip | |
pictordec: prevent segfault when reading corrupted files
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/pictordec.c')
| -rw-r--r-- | libavcodec/pictordec.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/libavcodec/pictordec.c b/libavcodec/pictordec.c index 09aae720e4..ca3e791f9a 100644 --- a/libavcodec/pictordec.c +++ b/libavcodec/pictordec.c @@ -202,13 +202,13 @@ static int decode_frame(AVCodecContext *avctx, y = s->height - 1; plane = 0; if (bytestream_get_le16(&buf)) { - while (buf_end - buf >= 6) { + while (y >= 0 && buf_end - buf >= 6) { const uint8_t *buf_pend = buf + FFMIN(AV_RL16(buf), buf_end - buf); //ignore uncompressed block size reported at buf[2] int marker = buf[4]; buf += 5; - while (plane < s->nb_planes && buf_pend - buf >= 1) { + while (plane < s->nb_planes && y >= 0 && buf_pend - buf >= 1) { int run = 1; int val = *buf++; if (val == marker) { @@ -222,8 +222,6 @@ static int decode_frame(AVCodecContext *avctx, if (bits_per_plane == 8) { picmemset_8bpp(s, val, run, &x, &y); - if (y < 0) - break; } else { picmemset(s, val, run, &x, &y, &plane, bits_per_plane); } |