[libav-devel] [PATCH] stream buffer value cannot be 0 fixes bug #131

[Shitiz Garg]

---
 libavcodec/qtrle.c |   32 +++++++++++++++++++++++++++++++-
 1 files changed, 31 insertions(+), 1 deletions(-)

diff --git a/libavcodec/qtrle.c b/libavcodec/qtrle.c
index 0c74798..1448e32 100644
--- a/libavcodec/qtrle.c
+++ b/libavcodec/qtrle.c
@@ -66,7 +66,7 @@ typedef struct QtrleContext {
 static void qtrle_decode_1bpp(QtrleContext *s, int stream_ptr, int row_ptr, 
int lines_to_change)
 {
     int rle_code;
-    int pixel_ptr = 0;
+    int pixel_ptr;
     int row_inc = s->frame.linesize[0];
     unsigned char pi0, pi1;  /* 2 8-pixel values */
     unsigned char *rgb = s->frame.data[0];
@@ -126,6 +126,12 @@ static inline void qtrle_decode_2n4bpp(QtrleContext *s, 
int stream_ptr,
 
     while (lines_to_change--) {
         CHECK_STREAM_PTR(2);
+
+        if (s->buf[stream_ptr] == 0) {
+            av_log(s->avctx, AV_LOG_ERROR, "buffer value cannot be zero\n");
+            return;
+        }
+
         pixel_ptr = row_ptr + (num_pixels * (s->buf[stream_ptr++] - 1));
 
         while ((rle_code = (signed char)s->buf[stream_ptr++]) != -1) {
@@ -182,6 +188,12 @@ static void qtrle_decode_8bpp(QtrleContext *s, int 
stream_ptr, int row_ptr, int
 
     while (lines_to_change--) {
         CHECK_STREAM_PTR(2);
+
+        if (s->buf[stream_ptr] == 0) {
+            av_log(s->avctx, AV_LOG_ERROR, "buffer value cannot be zero\n");
+            return;
+        }
+
         pixel_ptr = row_ptr + (4 * (s->buf[stream_ptr++] - 1));
 
         while ((rle_code = (signed char)s->buf[stream_ptr++]) != -1) {
@@ -235,6 +247,12 @@ static void qtrle_decode_16bpp(QtrleContext *s, int 
stream_ptr, int row_ptr, int
 
     while (lines_to_change--) {
         CHECK_STREAM_PTR(2);
+
+        if (s->buf[stream_ptr] == 0) {
+            av_log(s->avctx, AV_LOG_ERROR, "buffer value cannot be zero\n");
+            return;
+        }
+
         pixel_ptr = row_ptr + (s->buf[stream_ptr++] - 1) * 2;
 
         while ((rle_code = (signed char)s->buf[stream_ptr++]) != -1) {
@@ -284,6 +302,12 @@ static void qtrle_decode_24bpp(QtrleContext *s, int 
stream_ptr, int row_ptr, int
 
     while (lines_to_change--) {
         CHECK_STREAM_PTR(2);
+
+        if (s->buf[stream_ptr] == 0) {
+            av_log(s->avctx, AV_LOG_ERROR, "buffer value cannot be zero\n");
+            return;
+        }
+
         pixel_ptr = row_ptr + (s->buf[stream_ptr++] - 1) * 3;
 
         while ((rle_code = (signed char)s->buf[stream_ptr++]) != -1) {
@@ -334,6 +358,12 @@ static void qtrle_decode_32bpp(QtrleContext *s, int 
stream_ptr, int row_ptr, int
 
     while (lines_to_change--) {
         CHECK_STREAM_PTR(2);
+
+        if (s->buf[stream_ptr] == 0) {
+            av_log(s->avctx, AV_LOG_ERROR, "buffer value cannot be zero\n");
+            return;
+        }
+
         pixel_ptr = row_ptr + (s->buf[stream_ptr++] - 1) * 4;
 
         while ((rle_code = (signed char)s->buf[stream_ptr++]) != -1) {
-- 
1.7.5.4

_______________________________________________
libav-devel mailing list
libav-devel@libav.org
https://lists.libav.org/mailman/listinfo/libav-devel