diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-09-30 13:52:48 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-09-30 13:52:48 +0200 |
| commit | e5ce6d447b952658b8a8568c807baeab5cf58783 (patch) | |
| tree | 74af04c23abf7c610e0e944a7df4c7ca87f67a2f /libavcodec/dfa.c | |
| parent | 301f6da0397eb8955adf355229521997390d918a (diff) | |
| parent | d05f72c75445969cd7bdb1d860635c9880c67fb6 (diff) | |
Merge commit 'd05f72c75445969cd7bdb1d860635c9880c67fb6'
* commit 'd05f72c75445969cd7bdb1d860635c9880c67fb6':
dfa: improve boundary checks in decode_dds1()
wmalosslessdec: Fix reading too many bits in decode_channel_residues()
wmalosslessdec: fix a get_bits(0) in decode_ac_filter
wmalosslessdec: make MCLMS arrays big enough for what is written into them.
indeo4/5: check empty tile size in decode_mb_info().
ivi_common: make ff_ivi_process_empty_tile() static.
indeo5: check tile size in decode_mb_info().
indeo3: fix out of cell write.
Conflicts:
libavcodec/dfa.c
libavcodec/indeo3.c
libavcodec/indeo5.c
libavcodec/ivi_common.c
libavcodec/wmalosslessdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/dfa.c')
| -rw-r--r-- | libavcodec/dfa.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/libavcodec/dfa.c b/libavcodec/dfa.c index e4b940cc60..115973132f 100644 --- a/libavcodec/dfa.c +++ b/libavcodec/dfa.c @@ -157,8 +157,7 @@ static int decode_dds1(GetByteContext *gb, uint8_t *frame, int width, int height bitbuf = bytestream2_get_le16u(gb); mask = 1; } - if (frame_end - frame < width + 2) - return AVERROR_INVALIDDATA; + if (bitbuf & mask) { v = bytestream2_get_le16(gb); offset = (v & 0x1FFF) << 2; @@ -172,9 +171,12 @@ static int decode_dds1(GetByteContext *gb, uint8_t *frame, int width, int height frame += 2; } } else if (bitbuf & (mask << 1)) { - frame += bytestream2_get_le16(gb) * 2; + v = bytestream2_get_le16(gb)*2; + if (frame - frame_end < v) + return AVERROR_INVALIDDATA; + frame += v; } else { - if (frame_end - frame < width + 2) + if (frame_end - frame < width + 3) return AVERROR_INVALIDDATA; frame[0] = frame[1] = frame[width] = frame[width + 1] = bytestream2_get_byte(gb); |