1. ffmpeg
  2. Commit e1a46eff7a1017e1d3afc5204b82e08a1ea0bf3d
Browse code

qtrle: check for invalid line offset

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a4ed7c3fe9f99b89f86b65710d8855dc572f1a25)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 67c46b9b3027fdd9fd737e21a80d3326748b1c15)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Laurent Aimar authored on 2011/10/09 06:01:33
Showing 1 changed files
libavcodec/qtrle.c
History View file @ e1a46ef
... ... 
@@ -461,6 +461,8 @@ static int qtrle_decode_frame(AVCodecContext *avctx,
461 461 
         stream_ptr += 4;
462 462 
         height = AV_RB16(&s->buf[stream_ptr]);
463 463 
         stream_ptr += 4;
464 
+        if (height > s->avctx->height - start_line)
465 
+            goto done;
464 466 
     } else {
465 467 
         start_line = 0;
466 468 
         height = s->avctx->height;