rpza: limit the number of blocks to the total remaining blocks in the frame

Fixes invalid writes. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC:libav-stable@libav.org
11 years ago · 77bb0004bb
parent a46dc49744
commit 77bb0004bb
1 changed files with 2 additions and 0 deletions
--- a/libavcodec/rpza.c
+++ b/libavcodec/rpza.c
@ -119,6 +119,8 @@ static void rpza_decode_stream(RpzaContext *s)
            }
        }

+        n_blocks = FFMIN(n_blocks, total_blocks);
+
        switch (opcode & 0xe0) {

        /* Skip blocks */