qpeg: Add checks for running out of rows in qpeg_decode_inter

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org Signed-off-by: Martin Storsjö <martin@martin.st>
12 years ago · 7a5a557227
parent e9d61de96c
commit 7a5a557227
1 changed files with 4 additions and 0 deletions
--- a/libavcodec/qpeg.c
+++ b/libavcodec/qpeg.c
@ -191,6 +191,8 @@ static void qpeg_decode_inter(QpegContext *qctx, uint8_t *dst,
                    filled = 0;
                    dst -= stride;
                    height--;
+                    if (height < 0)
+                        break;
                }
            }
        } else if(code >= 0xC0) { /* copy code: 0xC0..0xDF */
@ -202,6 +204,8 @@ static void qpeg_decode_inter(QpegContext *qctx, uint8_t *dst,
                    filled = 0;
                    dst -= stride;
                    height--;
+                    if (height < 0)
+                        break;
                }
            }
        } else if(code >= 0x80) { /* skip code: 0x80..0xBF */