[FFmpeg-cvslog] pcx: Check the packet size before assuming it fits a palette

[Martin Storsjö]

ffmpeg | branch: release/0.10 | Martin Storsjö <martin at martin.st> | Sun Sep 29 13:02:27 2013 +0300| [d92c908e235a0632176b1b037860c73bcd2ed97f] | committer: Luca Barbato

pcx: Check the packet size before assuming it fits a palette

This fixes reads out of bounds.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org
Signed-off-by: Martin Storsjö <martin at martin.st>
(cherry picked from commit d1d99e3befea5d411ac3aae72dbdecce94f8b547)
Signed-off-by: Luca Barbato <lu_zero at gentoo.org>

Conflicts:
	libavcodec/pcx.c
(cherry picked from commit 7e350b7ddd19af856b55634233d609e29baab646)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d92c908e235a0632176b1b037860c73bcd2ed97f
---

 libavcodec/pcx.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/libavcodec/pcx.c b/libavcodec/pcx.c
index 0e82012..8419e5c 100644
--- a/libavcodec/pcx.c
+++ b/libavcodec/pcx.c
@@ -183,7 +183,13 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
     } else if (nplanes == 1 && bits_per_pixel == 8) {
         const uint8_t *palstart = bufstart + buf_size - 769;
 
-        for (y=0; y<h; y++, ptr+=stride) {
+        if (buf_size < 769) {
+            av_log(avctx, AV_LOG_ERROR, "File is too short\n");
+            ret = buf_size;
+            goto end;
+        }
+
+        for (y = 0; y < h; y++, ptr += stride) {
             buf = pcx_rle_decode(buf, buf_end,
                                  scanline, bytes_per_scanline, compressed);
             memcpy(ptr, scanline, w);