From 00aad121d8a6f365641345a8321bdaac1ff80649 Mon Sep 17 00:00:00 2001
From: Aneesh Dogra <lionaneesh@gmail.com>
Date: Tue, 20 Dec 2011 00:00:30 +0530
Subject: xl: Fix overreads
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Martin Storsjö <martin@martin.st>
---
 libavcodec/xl.c | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'libavcodec/xl.c')

diff --git a/libavcodec/xl.c b/libavcodec/xl.c
index 197b0c24a2..0ebc9467e0 100644
--- a/libavcodec/xl.c
+++ b/libavcodec/xl.c
@@ -68,6 +68,12 @@ static int decode_frame(AVCodecContext *avctx,
     V = a->pic.data[2];
 
     stride = avctx->width - 4;
+
+    if (buf_size < avctx->width * avctx->height) {
+        av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     for (i = 0; i < avctx->height; i++) {
         /* lines are stored in reversed order */
         buf += stride;
-- 
cgit v1.2.3