diff options
Diffstat (limited to 'libavcodec/dfa.c')
| -rw-r--r-- | libavcodec/dfa.c | 16 |
1 files changed, 9 insertions, 7 deletions
diff --git a/libavcodec/dfa.c b/libavcodec/dfa.c index 4c77f4e273..32459098a7 100644 --- a/libavcodec/dfa.c +++ b/libavcodec/dfa.c @@ -292,17 +292,19 @@ static int decode_tdlt(GetByteContext *gb, uint8_t *frame, int width, int height { const uint8_t *frame_end = frame + width * height; uint32_t segments = bytestream2_get_le32(gb); + int skip, copy; while (segments--) { - int count = bytestream2_get_byte(gb) << 1; - int skip = bytestream2_get_byte(gb) << 1; - - if (frame_end - frame < skip + count) + if (bytestream2_get_bytes_left(gb) < 2) return AVERROR_INVALIDDATA; - frame += skip; - if (bytestream2_get_buffer(gb, frame, count) != count) + copy = bytestream2_get_byteu(gb) * 2; + skip = bytestream2_get_byteu(gb) * 2; + if (frame_end - frame < copy + skip || + bytestream2_get_bytes_left(gb) < copy) return AVERROR_INVALIDDATA; - frame += count; + frame += skip; + bytestream2_get_buffer(gb, frame, copy); + frame += copy; } return 0; |