[libav-stable] rpza: Fix a buffer size check

Martin Storsjö git at libav.org
Sun Sep 29 19:07:52 CEST 2013


Module: libav
Branch: master
Commit: 7ba0cedbfeff5671b264d1d7e90777057b5714c6

Author:    Martin Storsjö <martin at martin.st>
Committer: Martin Storsjö <martin at martin.st>
Date:      Sun Sep 29 01:24:20 2013 +0300

rpza: Fix a buffer size check

We read 2 bytes for 15 out of 16 pixels, therefore we need to
have at least 30 bytes, not 16.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org
Signed-off-by: Martin Storsjö <martin at martin.st>

---

 libavcodec/rpza.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/rpza.c b/libavcodec/rpza.c
index 45350a8..ca9f7ea 100644
--- a/libavcodec/rpza.c
+++ b/libavcodec/rpza.c
@@ -204,7 +204,7 @@ static void rpza_decode_stream(RpzaContext *s)
 
         /* Fill block with 16 colors */
         case 0x00:
-            if (s->size - stream_ptr < 16)
+            if (s->size - stream_ptr < 30)
                 return;
             block_ptr = row_ptr + pixel_ptr;
             for (pixel_y = 0; pixel_y < 4; pixel_y++) {



More information about the libav-stable mailing list