[FFmpeg-cvslog] qpeg: Add checks for running out of rows in qpeg_decode_inter

[Martin Storsjö]

ffmpeg | branch: release/0.10 | Martin Storsjö <martin at martin.st> | Thu Sep 19 15:53:31 2013 +0300| [2c3114158510d05346e362d381a3b352175e260e] | committer: Luca Barbato

qpeg: Add checks for running out of rows in qpeg_decode_inter

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org
Signed-off-by: Martin Storsjö <martin at martin.st>
(cherry picked from commit 7a5a55722749a3ab77941914707277b147322cbe)
Signed-off-by: Luca Barbato <lu_zero at gentoo.org>
(cherry picked from commit 4d90550cf95eac0451465116d6e53bac37b96927)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2c3114158510d05346e362d381a3b352175e260e
---

 libavcodec/qpeg.c |    4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/qpeg.c b/libavcodec/qpeg.c
index 9513dd0..9897f16 100644
--- a/libavcodec/qpeg.c
+++ b/libavcodec/qpeg.c
@@ -198,6 +198,8 @@ static void qpeg_decode_inter(const uint8_t *src, uint8_t *dst, int size,
                     filled = 0;
                     dst -= stride;
                     height--;
+                    if (height < 0)
+                        break;
                 }
             }
         } else if(code >= 0xC0) { /* copy code: 0xC0..0xDF */
@@ -209,6 +211,8 @@ static void qpeg_decode_inter(const uint8_t *src, uint8_t *dst, int size,
                     filled = 0;
                     dst -= stride;
                     height--;
+                    if (height < 0)
+                        break;
                 }
             }
             size -= code + 1;