diff options
| -rw-r--r-- | libavcodec/rv34.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/rv34.c b/libavcodec/rv34.c index 297a1a7635..ec80035ac8 100644 --- a/libavcodec/rv34.c +++ b/libavcodec/rv34.c @@ -1389,6 +1389,11 @@ int ff_rv34_decode_frame(AVCodecContext *avctx, else size= get_slice_offset(avctx, slices_hdr, i+1) - offset; + if(offset > buf_size){ + av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n"); + break; + } + r->si.end = s->mb_width * s->mb_height; if(i+1 < slice_count){ init_get_bits(&s->gb, buf+get_slice_offset(avctx, slices_hdr, i+1), (buf_size-get_slice_offset(avctx, slices_hdr, i+1))*8); |