Bug-Id: 887
CC: libav-stable@libav.org
while (bytestream2_get_bytes_left(&s->gb) > 0) {
int run_length, color;
- if (y >= s->avctx->height)
+ // writes one more line when half_vert is true
+ if (y >= s->avctx->height + !!half_vert)
return 0;
color = bytestream2_get_byte(&s->gb);
if (half_horiz)
run_length *=2;
+ if (s->avctx->width - x < run_length)
+ return AVERROR_INVALIDDATA;
+
if (color) {
memset(s->frame->data[0] + y*s->frame->linesize[0] + x, color, run_length);
if (half_vert)