diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-12-23 03:00:12 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-12-23 03:25:51 +0100 |
| commit | d1c28e35300130f0ee28a3e5bbeb2cea403fad57 (patch) | |
| tree | a18d0b0989962e2e2cab201fbf6128ae8332d8a4 /libavcodec/4xm.c | |
| parent | 9f50dafe9025555f11e66e3b09cf3db2cd53cfb2 (diff) | |
| parent | 4e8d6218c3cb8b9feffb70f8a53859540b975b36 (diff) | |
Merge remote-tracking branch 'qatar/master'
* qatar/master:
build: fix standalone compilation of OMA muxer
build: fix standalone compilation of Microsoft XMV demuxer
build: fix standalone compilation of Core Audio Format demuxer
kvmc: fix invalid reads
4xm: Add a check in decode_i_frame to prevent buffer overreads
adpcm: fix IMA SMJPEG decoding
options: set minimum for "threads" to zero
bsd: use number of logical CPUs as automatic thread count
windows: use number of CPUs as automatic thread count
linux: use number of CPUs as automatic thread count
pthreads: reset active_thread_type when slice thread_init returrns early
v410dec: include correct headers
Drop ALT_ prefix from BITSTREAM_READER_LE name.
lavfi: always build vsrc_buffer.
ra144enc: zero the reflection coeffs if the filter is unstable
sws: readd PAL8 to isPacked()
mov: Don't stick the QuickTime field ordering atom in extradata.
truespeech: fix invalid reads in truespeech_apply_twopoint_filter()
Conflicts:
configure
libavcodec/4xm.c
libavcodec/avcodec.h
libavfilter/Makefile
libavfilter/allfilters.c
libavformat/Makefile
libswscale/swscale_internal.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/4xm.c')
| -rw-r--r-- | libavcodec/4xm.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c index 370fe6df47..5dcb6d8276 100644 --- a/libavcodec/4xm.c +++ b/libavcodec/4xm.c @@ -688,10 +688,13 @@ static int decode_i_frame(FourXContext *f, const uint8_t *buf, int length){ unsigned int prestream_size; const uint8_t *prestream; - if (bitstream_size > (1<<26) || length < bitstream_size + 12) - return -1; - prestream_size = 4*AV_RL32(buf + bitstream_size + 4); - prestream = buf + bitstream_size + 12; + if (bitstream_size > (1<<26) || length < bitstream_size + 12) { + av_log(f->avctx, AV_LOG_ERROR, "packet size too small\n"); + return AVERROR_INVALIDDATA; + } + + prestream_size = 4 * AV_RL32(buf + bitstream_size + 4); + prestream = buf + bitstream_size + 12; if (prestream_size > (1<<26) || prestream_size != length - (bitstream_size + 12)){ |