diff options
Diffstat (limited to 'libavcodec/fic.c')
| -rw-r--r-- | libavcodec/fic.c | 19 |
1 files changed, 10 insertions, 9 deletions
diff --git a/libavcodec/fic.c b/libavcodec/fic.c index df034371e0..63faef2687 100644 --- a/libavcodec/fic.c +++ b/libavcodec/fic.c @@ -4,20 +4,20 @@ * Copyright (c) 2014 Konstantin Shishkov * Copyright (c) 2014 Derek Buitenhuis * - * This file is part of Libav. + * This file is part of FFmpeg. * - * Libav is free software; you can redistribute it and/or + * FFmpeg is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; either * version 2.1 of the License, or (at your option) any later version. * - * Libav is distributed in the hope that it will be useful, + * FFmpeg is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public - * License along with Libav; if not, write to the Free Software + * License along with FFmpeg; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ @@ -216,10 +216,11 @@ static int fic_decode_frame(AVCodecContext *avctx, void *data, av_log(avctx, AV_LOG_ERROR, "Could not allocate slice data.\n"); return AVERROR(ENOMEM); } + memset(ctx->slice_data, 0, nslices * sizeof(ctx->slice_data[0])); for (slice = 0; slice < nslices; slice++) { - int slice_off = AV_RB32(src + tsize + FIC_HEADER_SIZE + slice * 4); - int slice_size; + unsigned slice_off = AV_RB32(src + tsize + FIC_HEADER_SIZE + slice * 4); + unsigned slice_size; int y_off = ctx->slice_h * slice; int slice_h = ctx->slice_h; @@ -234,11 +235,11 @@ static int fic_decode_frame(AVCodecContext *avctx, void *data, slice_size = AV_RB32(src + tsize + FIC_HEADER_SIZE + slice * 4 + 4); } - slice_size -= slice_off; - - if (slice_off > msize || slice_off + slice_size > msize) + if (slice_size < slice_off || slice_size > msize) continue; + slice_size -= slice_off; + ctx->slice_data[slice].src = sdata + slice_off; ctx->slice_data[slice].src_size = slice_size; ctx->slice_data[slice].slice_h = slice_h; |