Fixes invalid reads.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:[email protected]
---
libavcodec/pcx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/pcx.c b/libavcodec/pcx.c
index 1a5357b..61c971e 100644
--- a/libavcodec/pcx.c
+++ b/libavcodec/pcx.c
@@ -109,7 +109,7 @@ static int pcx_decode_frame(AVCodecContext *avctx, void
*data, int *got_frame,
nplanes = buf[65];
bytes_per_scanline = nplanes * bytes_per_line;
- if (bytes_per_scanline < w * bits_per_pixel * nplanes / 8 ||
+ if (bytes_per_scanline < (w * bits_per_pixel * nplanes + 7) / 8 ||
(!compressed && bytes_per_scanline > buf_size / h)) {
av_log(avctx, AV_LOG_ERROR, "PCX data is corrupted\n");
return AVERROR_INVALIDDATA;
--
1.7.10.4
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
