Merge commit 'b2788fe9347c02b1355574f3d28d60bfe1250ea7'

* commit 'b2788fe9347c02b1355574f3d28d60bfe1250ea7':
  svq3: fix the slice size check

Merged-by: James Almer <jamrial@gmail.com>

1 files changed, 4 insertions, 5 deletions

diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c
index 5cb5bd45b7..a937b2f951 100644
--- a/libavcodec/svq3.c
+++ b/libavcodec/svq3.c
@@ -1036,17 +1036,16 @@ static int svq3_decode_slice_header(AVCodecContext *avctx)
         slice_bits   = slice_length * 8;
         slice_bytes  = slice_length + length - 1;
 
-        if (8LL*slice_bytes > get_bits_left(&s->gb)) {
-            av_log(avctx, AV_LOG_ERROR, "slice after bitstream end\n");
-            return -1;
-        }
-
         skip_bits(&s->gb, 8);
 
         av_fast_malloc(&s->slice_buf, &s->slice_size, slice_bytes + AV_INPUT_BUFFER_PADDING_SIZE);
         if (!s->slice_buf)
             return AVERROR(ENOMEM);
 
+        if (slice_bytes * 8LL > get_bits_left(&s->gb)) {
+            av_log(avctx, AV_LOG_ERROR, "slice after bitstream end\n");
+            return AVERROR_INVALIDDATA;
+        }
         memcpy(s->slice_buf, s->gb.buffer + s->gb.index / 8, slice_bytes);
 
         init_get_bits(&s->gb_slice, s->slice_buf, slice_bits);