[FFmpeg-cvslog] qpeg: Add checks for running out of rows in qpeg_decode_inter

[Martin Storsjö]

ffmpeg | branch: master | Martin Storsjö <martin at martin.st> | Thu Sep 19 15:53:31 2013 +0300| [7a5a55722749a3ab77941914707277b147322cbe] | committer: Martin Storsjö

qpeg: Add checks for running out of rows in qpeg_decode_inter

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org
Signed-off-by: Martin Storsjö <martin at martin.st>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7a5a55722749a3ab77941914707277b147322cbe
---

 libavcodec/qpeg.c |    4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/qpeg.c b/libavcodec/qpeg.c
index bb963ed..a3a5db5 100644
--- a/libavcodec/qpeg.c
+++ b/libavcodec/qpeg.c
@@ -191,6 +191,8 @@ static void qpeg_decode_inter(QpegContext *qctx, uint8_t *dst,
                     filled = 0;
                     dst -= stride;
                     height--;
+                    if (height < 0)
+                        break;
                 }
             }
         } else if(code >= 0xC0) { /* copy code: 0xC0..0xDF */
@@ -202,6 +204,8 @@ static void qpeg_decode_inter(QpegContext *qctx, uint8_t *dst,
                     filled = 0;
                     dst -= stride;
                     height--;
+                    if (height < 0)
+                        break;
                 }
             }
         } else if(code >= 0x80) { /* skip code: 0x80..0xBF */