mmvideo: Make sure the rle does not write over the frame boundaries

Bug-Id: 887
CC: libav-stable@libav.org
pull/151/head
Luca Barbato 9 years ago
parent 41ed749fe9
commit 9b5a4a9cce
  1. 6
      libavcodec/mmvideo.c

@ -99,7 +99,8 @@ static int mm_decode_intra(MmContext * s, int half_horiz, int half_vert)
while (bytestream2_get_bytes_left(&s->gb) > 0) { while (bytestream2_get_bytes_left(&s->gb) > 0) {
int run_length, color; int run_length, color;
if (y >= s->avctx->height) // writes one more line when half_vert is true
if (y >= s->avctx->height + !!half_vert)
return 0; return 0;
color = bytestream2_get_byte(&s->gb); color = bytestream2_get_byte(&s->gb);
@ -113,6 +114,9 @@ static int mm_decode_intra(MmContext * s, int half_horiz, int half_vert)
if (half_horiz) if (half_horiz)
run_length *=2; run_length *=2;
if (s->avctx->width - x < run_length)
return AVERROR_INVALIDDATA;
if (color) { if (color) {
memset(s->frame->data[0] + y*s->frame->linesize[0] + x, color, run_length); memset(s->frame->data[0] + y*s->frame->linesize[0] + x, color, run_length);
if (half_vert) if (half_vert)

Loading…
Cancel
Save