From 0ac3b8fc4aeb1755717f44482f3236134a5b8405 Mon Sep 17 00:00:00 2001
From: Justin Ruggles <justin.ruggles@gmail.com>
Date: Tue, 6 Sep 2011 18:43:55 -0400
Subject: 8svx: check packet size before reading the initial sample value.

---
 libavcodec/8svx.c | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'libavcodec/8svx.c')

diff --git a/libavcodec/8svx.c b/libavcodec/8svx.c
index adface26ce..0f53d39a8d 100644
--- a/libavcodec/8svx.c
+++ b/libavcodec/8svx.c
@@ -74,6 +74,10 @@ static int eightsvx_decode_frame(AVCodecContext *avctx, void *data, int *data_si
     int consumed = buf_size;
 
     if(avctx->frame_number == 0) {
+        if (buf_size < 2) {
+            av_log(avctx, AV_LOG_ERROR, "packet size is too small\n");
+            return AVERROR(EINVAL);
+        }
         esc->fib_acc = (int8_t)buf[1] + 128;
         buf_size -= 2;
         buf += 2;
-- 
cgit v1.2.3