diff options
| author | Mans Rullgard <mans@mansr.com> | 2011-10-15 14:35:49 +0100 |
|---|---|---|
| committer | Mans Rullgard <mans@mansr.com> | 2011-10-15 14:59:44 +0100 |
| commit | 91038cdbd160310174aad6833d1d08c65d850e78 (patch) | |
| tree | 9d454931e8ac76924bef965dba4aad0c14ae7e81 /libavcodec/proresdec.c | |
| parent | cd14e297e63c89dfe44ebfe4e6a82b617352a081 (diff) | |
prores: get correct size for coded V plane if alpha is present
The size check must be updated to take into account both manners
in which v_data_size might be set.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Diffstat (limited to 'libavcodec/proresdec.c')
| -rw-r--r-- | libavcodec/proresdec.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavcodec/proresdec.c b/libavcodec/proresdec.c index ca465f4d8e..b4c794564b 100644 --- a/libavcodec/proresdec.c +++ b/libavcodec/proresdec.c @@ -546,9 +546,11 @@ static int decode_slice(AVCodecContext *avctx, ProresThreadData *td) hdr_size = buf[0] >> 3; y_data_size = AV_RB16(buf + 2); u_data_size = AV_RB16(buf + 4); - v_data_size = slice_data_size - y_data_size - u_data_size - hdr_size; + v_data_size = hdr_size > 7 ? AV_RB16(buf + 6) : + slice_data_size - y_data_size - u_data_size - hdr_size; - if (v_data_size < 0 || hdr_size < 6) { + if (hdr_size + y_data_size + u_data_size + v_data_size > slice_data_size || + v_data_size < 0 || hdr_size < 6) { av_log(avctx, AV_LOG_ERROR, "invalid data size\n"); return AVERROR_INVALIDDATA; } |