1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/lagarith.c b/libavcodec/lagarith.c
index 02d3533b0c..059d7f7893 100644
--- a/libavcodec/lagarith.c
+++ b/libavcodec/lagarith.c
@@ -322,6 +322,11 @@ static int lag_decode_zero_run_line(LagarithContext *l, uint8_t *dst,
 output_zeros:
     if (l->zeros_rem) {
         count = FFMIN(l->zeros_rem, width - i);
+        if (end - dst < count) {
+            av_log(l->avctx, AV_LOG_ERROR, "Too many zeros remaining.\n");
+            return AVERROR_INVALIDDATA;
+        }
+
         memset(dst, 0, count);
         l->zeros_rem -= count;
         dst += count;