diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-04-17 16:19:14 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-04-17 16:20:49 +0200 |
| commit | e5dc5095f9fad406eb8c925892fbd655c68adffc (patch) | |
| tree | a803648c805fc1c0c4fd201250f3bdb7955cd167 | |
| parent | 4916e220a60a08c8bf6c7da0786e4a29b14d93d6 (diff) | |
| parent | 01d376f598fe95478036f5d1e3e5e14ffe32d4bf (diff) | |
Merge commit '01d376f598fe95478036f5d1e3e5e14ffe32d4bf'
* commit '01d376f598fe95478036f5d1e3e5e14ffe32d4bf':
rv10: check that extradata is large enough
Merged-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/rv10.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/rv10.c b/libavcodec/rv10.c index e410723008..8ee33910bf 100644 --- a/libavcodec/rv10.c +++ b/libavcodec/rv10.c @@ -350,6 +350,11 @@ static int rv20_decode_picture_header(RVDecContext *rv) f = get_bits(&s->gb, rpr_bits); if (f) { + if (s->avctx->extradata_size < 8 + 2 * f) { + av_log(s->avctx, AV_LOG_ERROR, "Extradata too small.\n"); + return AVERROR_INVALIDDATA; + } + new_w = 4 * ((uint8_t*)s->avctx->extradata)[6 + 2 * f]; new_h = 4 * ((uint8_t*)s->avctx->extradata)[7 + 2 * f]; } else { |