Commit 7a5a5572 authored by Martin Storsjö's avatar Martin Storsjö

qpeg: Add checks for running out of rows in qpeg_decode_inter

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: 's avatarMartin Storsjö <martin@martin.st>
parent e9d61de9
...@@ -191,6 +191,8 @@ static void qpeg_decode_inter(QpegContext *qctx, uint8_t *dst, ...@@ -191,6 +191,8 @@ static void qpeg_decode_inter(QpegContext *qctx, uint8_t *dst,
filled = 0; filled = 0;
dst -= stride; dst -= stride;
height--; height--;
if (height < 0)
break;
} }
} }
} else if(code >= 0xC0) { /* copy code: 0xC0..0xDF */ } else if(code >= 0xC0) { /* copy code: 0xC0..0xDF */
...@@ -202,6 +204,8 @@ static void qpeg_decode_inter(QpegContext *qctx, uint8_t *dst, ...@@ -202,6 +204,8 @@ static void qpeg_decode_inter(QpegContext *qctx, uint8_t *dst,
filled = 0; filled = 0;
dst -= stride; dst -= stride;
height--; height--;
if (height < 0)
break;
} }
} }
} else if(code >= 0x80) { /* skip code: 0x80..0xBF */ } else if(code >= 0x80) { /* skip code: 0x80..0xBF */
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment