lavc/qdrw: Fix overwrite when reading invalid Quickdraw images.

1eda5551 · Carl Eugen Hoyos · e609cfd6 · 1eda5551
Commit 1eda5551 authored May 16, 2015 by Carl Eugen Hoyos
Hide whitespace changes
Inline Side-by-side

Showing with 4 additions and 0 deletions

qdrw.c libavcodec/qdrw.c +4 -0

No files found.
--- a/libavcodec/qdrw.c
+++ b/libavcodec/qdrw.c
@@ -95,6 +95,8 @@ static int decode_rle(AVCodecContext *avctx, AVFrame *p, GetByteContext *gbc,
                        pos -= offset;
                        pos++;
                    }
+                    if (pos >= offset)
+                        return AVERROR_INVALIDDATA;
                }
                left  -= 2;
            } else { /* copy */
@@ -105,6 +107,8 @@ static int decode_rle(AVCodecContext *avctx, AVFrame *p, GetByteContext *gbc,
                        pos -= offset;
                        pos++;
                    }
+                    if (pos >= offset)
+                        return AVERROR_INVALIDDATA;
                }
                left  -= 2 + code;
            }