avcodec/bmp_parser: Ensure remaining_size is not too small in startcode packet crossing corner case

Fixes Ticket 5438 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 years ago · 8e26bdd59b
parent e1a8f7818c
commit 8e26bdd59b
1 changed files with 1 additions and 1 deletions
--- a/libavcodec/bmp_parser.c
+++ b/libavcodec/bmp_parser.c
@ -63,7 +63,7 @@ restart:
                    continue;
                }
                bpc->pc.frame_start_found++;
-                bpc->remaining_size = bpc->fsize + i - 17;
+                bpc->remaining_size = bpc->fsize + FFMAX(i - 17, 0);

                if (bpc->pc.index + i > 17) {
                    next = i - 17;