avcodec/qdrw: check bytes per scanline for 2bpp images

One byte less is read in case of small width. Closes #6194. Signed-off-by: Paul B Mahol <onemda@gmail.com>
BtbN · Feb 27, 2017 · 26a7d6a · 26a7d6a
1 parent 86ab6b6
commit 26a7d6a
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/libavcodec/qdrw.c b/libavcodec/qdrw.c
@@ -81,7 +81,10 @@ static int decode_rle_bpp2(AVCodecContext *avctx, AVFrame *p, GetByteContext *gb
         int pos = 0;
 
         /* size of packed line */
-        size = left = bytestream2_get_be16(gbc);
+        if (offset / 4 > 200)
+            size = left = bytestream2_get_be16(gbc);
+        else
+            size = left = bytestream2_get_byte(gbc);
         if (bytestream2_get_bytes_left(gbc) < size)
             return AVERROR_INVALIDDATA;