From 26a7d6a301b9b6c67153c87d42db145cdc0e57cf Mon Sep 17 00:00:00 2001
From: Paul B Mahol <onemda@gmail.com>
Date: Mon, 27 Feb 2017 14:15:11 +0100
Subject: [PATCH] avcodec/qdrw: check bytes per scanline for 2bpp images
One byte less is read in case of small width.
Closes #6194.
Signed-off-by: Paul B Mahol <onemda@gmail.com>
---
libavcodec/qdrw.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/libavcodec/qdrw.c b/libavcodec/qdrw.c
index 20e673a515b..c92cd85f12a 100644
--- a/libavcodec/qdrw.c
+++ b/libavcodec/qdrw.c
@@ -81,7 +81,10 @@ static int decode_rle_bpp2(AVCodecContext *avctx, AVFrame *p, GetByteContext *gb
int pos = 0;
/* size of packed line */
- size = left = bytestream2_get_be16(gbc);
+ if (offset / 4 > 200)
+ size = left = bytestream2_get_be16(gbc);
+ else
+ size = left = bytestream2_get_byte(gbc);
if (bytestream2_get_bytes_left(gbc) < size)
return AVERROR_INVALIDDATA;
--
GitLab