[FFmpeg-cvslog] qpeg: Add checks for running out of rows in qpeg_decode_inter

[Martin Storsjö]

ffmpeg | branch: release/1.1 | Martin Storsjö <martin at martin.st> | Thu Sep 19 15:53:31 2013 +0300| [4d90550cf95eac0451465116d6e53bac37b96927] | committer: Luca Barbato

qpeg: Add checks for running out of rows in qpeg_decode_inter

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org
Signed-off-by: Martin Storsjö <martin at martin.st>
(cherry picked from commit 7a5a55722749a3ab77941914707277b147322cbe)
Signed-off-by: Luca Barbato <lu_zero at gentoo.org>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4d90550cf95eac0451465116d6e53bac37b96927
---

 libavcodec/qpeg.c |    4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/qpeg.c b/libavcodec/qpeg.c
index 4a918e7..75e1223 100644
--- a/libavcodec/qpeg.c
+++ b/libavcodec/qpeg.c
@@ -190,6 +190,8 @@ static void qpeg_decode_inter(QpegContext *qctx, uint8_t *dst,
                     filled = 0;
                     dst -= stride;
                     height--;
+                    if (height < 0)
+                        break;
                 }
             }
         } else if(code >= 0xC0) { /* copy code: 0xC0..0xDF */
@@ -201,6 +203,8 @@ static void qpeg_decode_inter(QpegContext *qctx, uint8_t *dst,
                     filled = 0;
                     dst -= stride;
                     height--;
+                    if (height < 0)
+                        break;
                 }
             }
         } else if(code >= 0x80) { /* skip code: 0x80..0xBF */