From f062947261447112c8026e2f329a685daa415936 Mon Sep 17 00:00:00 2001
From: Paul B Mahol <onemda@gmail.com>
Date: Thu, 23 Feb 2017 15:20:24 +0100
Subject: [PATCH] avcodec/qdrw: do better w/h parsing for direct bit packing

Apparently using 0x0001 opcode solely is not correct.
Try this instead.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
---
 libavcodec/qdrw.c | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/libavcodec/qdrw.c b/libavcodec/qdrw.c
index 2462e2ffcc..e650f49547 100644
--- a/libavcodec/qdrw.c
+++ b/libavcodec/qdrw.c
@@ -310,7 +310,7 @@ static int decode_frame(AVCodecContext *avctx,
     AVFrame * const p      = data;
     GetByteContext gbc;
     int colors;
-    int w, h, x0, y0, x1, y1, ret;
+    int w, h, ret;
     int ver;
 
     bytestream2_init(&gbc, avpkt->data, avpkt->size);
@@ -355,14 +355,7 @@ static int decode_frame(AVCodecContext *avctx,
 
         switch(opcode) {
         case CLIP:
-            bytestream2_get_be16(&gbc);
-            y0 = bytestream2_get_be16(&gbc);
-            x0 = bytestream2_get_be16(&gbc);
-            y1 = bytestream2_get_be16(&gbc);
-            x1 = bytestream2_get_be16(&gbc);
-            ret = ff_set_dimensions(avctx, x1 - x0, y1 - y0);
-            if (ret < 0)
-                return ret;
+            bytestream2_skip(&gbc, 10);
             break;
         case PACKBITSRECT:
         case PACKBITSRGN:
@@ -437,7 +430,15 @@ static int decode_frame(AVCodecContext *avctx,
                 return AVERROR_PATCHWELCOME;
             }
 
-            bytestream2_skip(&gbc, 10);
+            bytestream2_skip(&gbc, 4);
+            h = bytestream2_get_be16(&gbc);
+            w = bytestream2_get_be16(&gbc);
+            bytestream2_skip(&gbc, 2);
+
+            ret = ff_set_dimensions(avctx, w, h);
+            if (ret < 0)
+                return ret;
+
             pack_type = bytestream2_get_be16(&gbc);
 
             bytestream2_skip(&gbc, 16);