rpza: Fix a buffer size check
We read 2 bytes for 15 out of 16 pixels, therefore we need to have at least 30 bytes, not 16. Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org Signed-off-by: Martin Storsjö <martin@martin.st>
This commit is contained in:
parent
aa0dd52434
commit
7ba0cedbfe
@ -204,7 +204,7 @@ static void rpza_decode_stream(RpzaContext *s)
|
||||
|
||||
/* Fill block with 16 colors */
|
||||
case 0x00:
|
||||
if (s->size - stream_ptr < 16)
|
||||
if (s->size - stream_ptr < 30)
|
||||
return;
|
||||
block_ptr = row_ptr + pixel_ptr;
|
||||
for (pixel_y = 0; pixel_y < 4; pixel_y++) {
|
||||
|
Loading…
x
Reference in New Issue
Block a user