rpza: limit the number of blocks to the total remaining blocks in the frame

Fixes invalid writes.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
This commit is contained in:
Anton Khirnov 2013-11-28 10:54:35 +01:00
parent a46dc49744
commit 77bb0004bb
1 changed files with 2 additions and 0 deletions

View File

@ -119,6 +119,8 @@ static void rpza_decode_stream(RpzaContext *s)
}
}
n_blocks = FFMIN(n_blocks, total_blocks);
switch (opcode & 0xe0) {
/* Skip blocks */