diff options
author | James Almer <jamrial@gmail.com> | 2017-10-03 20:28:51 -0300 |
---|---|---|
committer | James Almer <jamrial@gmail.com> | 2017-10-03 20:28:51 -0300 |
commit | cb222d73225adae76893f58c8283b32a9943094f (patch) | |
tree | e0446c686c8e700a9c4818d282b486bfeec4d0df /libavcodec/svq3.c | |
parent | d17a00379e7ab5601ffc7da0a53b0c9f9d48a567 (diff) | |
parent | b2788fe9347c02b1355574f3d28d60bfe1250ea7 (diff) |
Merge commit 'b2788fe9347c02b1355574f3d28d60bfe1250ea7'
* commit 'b2788fe9347c02b1355574f3d28d60bfe1250ea7':
svq3: fix the slice size check
Merged-by: James Almer <jamrial@gmail.com>
Diffstat (limited to 'libavcodec/svq3.c')
-rw-r--r-- | libavcodec/svq3.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c index 5cb5bd45b7..a937b2f951 100644 --- a/libavcodec/svq3.c +++ b/libavcodec/svq3.c @@ -1036,17 +1036,16 @@ static int svq3_decode_slice_header(AVCodecContext *avctx) slice_bits = slice_length * 8; slice_bytes = slice_length + length - 1; - if (8LL*slice_bytes > get_bits_left(&s->gb)) { - av_log(avctx, AV_LOG_ERROR, "slice after bitstream end\n"); - return -1; - } - skip_bits(&s->gb, 8); av_fast_malloc(&s->slice_buf, &s->slice_size, slice_bytes + AV_INPUT_BUFFER_PADDING_SIZE); if (!s->slice_buf) return AVERROR(ENOMEM); + if (slice_bytes * 8LL > get_bits_left(&s->gb)) { + av_log(avctx, AV_LOG_ERROR, "slice after bitstream end\n"); + return AVERROR_INVALIDDATA; + } memcpy(s->slice_buf, s->gb.buffer + s->gb.index / 8, slice_bytes); init_get_bits(&s->gb_slice, s->slice_buf, slice_bits); |