diff options
Diffstat (limited to 'libavcodec/eacmv.c')
| -rw-r--r-- | libavcodec/eacmv.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/eacmv.c b/libavcodec/eacmv.c index 8a8d6a9cef..82ec9fc9fc 100644 --- a/libavcodec/eacmv.c +++ b/libavcodec/eacmv.c @@ -162,8 +162,11 @@ static int cmv_decode_frame(AVCodecContext *avctx, return AVERROR_INVALIDDATA; if (AV_RL32(buf)==MVIh_TAG||AV_RB32(buf)==MVIh_TAG) { + unsigned size = AV_RL32(buf + 4); cmv_process_header(s, buf+EA_PREAMBLE_SIZE, buf_end); - return buf_size; + if (size > buf_end - buf - EA_PREAMBLE_SIZE) + return -1; + buf += size; } if (av_image_check_size(s->width, s->height, 0, s->avctx)) |