qpeg: Add checks for running out of rows in qpeg_decode_inter

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 7a5a557227)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This commit is contained in:
Martin Storsjö 2013-09-19 15:53:31 +03:00 committed by Luca Barbato
parent bacf5db196
commit 4d90550cf9

View File

@ -190,6 +190,8 @@ static void qpeg_decode_inter(QpegContext *qctx, uint8_t *dst,
filled = 0;
dst -= stride;
height--;
if (height < 0)
break;
}
}
} else if(code >= 0xC0) { /* copy code: 0xC0..0xDF */
@ -201,6 +203,8 @@ static void qpeg_decode_inter(QpegContext *qctx, uint8_t *dst,
filled = 0;
dst -= stride;
height--;
if (height < 0)
break;
}
}
} else if(code >= 0x80) { /* skip code: 0x80..0xBF */