diff options
| author | Alex Converse <alex.converse@gmail.com> | 2011-09-10 00:26:49 +0400 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2011-12-24 15:20:33 +0400 |
| commit | 7f163e5a8749845b8fb25337a1b7023a8d9d4bc0 (patch) | |
| tree | 63da6819af72f4773ab1acec8cfdfe832cf19113 /libavcodec | |
| parent | 23999c45bc559d8ce56f1f0f07468b3180fd48a0 (diff) | |
indeo2: fail if input buffer too small
(cherry picked from commit b7ce4f1d1c3add86ece7ca595ea6c4a10b471055)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/indeo2.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/libavcodec/indeo2.c b/libavcodec/indeo2.c index 7060578044..819c94bea1 100644 --- a/libavcodec/indeo2.c +++ b/libavcodec/indeo2.c @@ -156,6 +156,13 @@ static int ir2_decode_frame(AVCodecContext *avctx, return -1; } + start = 48; /* hardcoded for now */ + + if (start >= buf_size) { + av_log(s->avctx, AV_LOG_ERROR, "input buffer size too small (%d)\n", buf_size); + return AVERROR_INVALIDDATA; + } + s->decode_delta = buf[18]; /* decide whether frame uses deltas or not */ @@ -163,7 +170,6 @@ static int ir2_decode_frame(AVCodecContext *avctx, for (i = 0; i < buf_size; i++) buf[i] = av_reverse[buf[i]]; #endif - start = 48; /* hardcoded for now */ init_get_bits(&s->gb, buf + start, (buf_size - start) * 8); |