qtrle: check for invalid line offset
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a4ed7c3fe9f99b89f86b65710d8855dc572f1a25)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 67c46b9b3027fdd9fd737e21a80d3326748b1c15)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
diff --git a/libavcodec/qtrle.c b/libavcodec/qtrle.c
index d535c38..b66acd4 100644
--- a/libavcodec/qtrle.c
+++ b/libavcodec/qtrle.c
@@ -461,6 +461,8 @@
stream_ptr += 4;
height = AV_RB16(&s->buf[stream_ptr]);
stream_ptr += 4;
+ if (height > s->avctx->height - start_line)
+ goto done;
} else {
start_line = 0;
height = s->avctx->height;