Commit 26a7d6a3 authored by Paul B Mahol's avatar Paul B Mahol

avcodec/qdrw: check bytes per scanline for 2bpp images

One byte less is read in case of small width.
Closes #6194.
Signed-off-by: 's avatarPaul B Mahol <onemda@gmail.com>
parent 86ab6b6e
......@@ -81,7 +81,10 @@ static int decode_rle_bpp2(AVCodecContext *avctx, AVFrame *p, GetByteContext *gb
int pos = 0;
/* size of packed line */
size = left = bytestream2_get_be16(gbc);
if (offset / 4 > 200)
size = left = bytestream2_get_be16(gbc);
else
size = left = bytestream2_get_byte(gbc);
if (bytestream2_get_bytes_left(gbc) < size)
return AVERROR_INVALIDDATA;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment