[FFmpeg-cvslog] avcodec/qdrw: check bytes per scanline for 2bpp images

[Paul B Mahol]

ffmpeg | branch: master | Paul B Mahol <onemda at gmail.com> | Mon Feb 27 14:15:11 2017 +0100| [26a7d6a301b9b6c67153c87d42db145cdc0e57cf] | committer: Paul B Mahol

avcodec/qdrw: check bytes per scanline for 2bpp images

One byte less is read in case of small width.
Closes #6194.

Signed-off-by: Paul B Mahol <onemda at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=26a7d6a301b9b6c67153c87d42db145cdc0e57cf
---

 libavcodec/qdrw.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libavcodec/qdrw.c b/libavcodec/qdrw.c
index 20e673a..c92cd85 100644
--- a/libavcodec/qdrw.c
+++ b/libavcodec/qdrw.c
@@ -81,7 +81,10 @@ static int decode_rle_bpp2(AVCodecContext *avctx, AVFrame *p, GetByteContext *gb
         int pos = 0;
 
         /* size of packed line */
-        size = left = bytestream2_get_be16(gbc);
+        if (offset / 4 > 200)
+            size = left = bytestream2_get_be16(gbc);
+        else
+            size = left = bytestream2_get_byte(gbc);
         if (bytestream2_get_bytes_left(gbc) < size)
             return AVERROR_INVALIDDATA;