From 18a508c52771b52ac3a042fd59a95a7e97fac9ae Mon Sep 17 00:00:00 2001
From: Mike Melanson <mike@multimedia.cx>
Date: Sat, 31 Jan 2004 18:17:38 +0000
Subject: handle invalid buffer sizes

Originally committed as revision 2734 to svn://svn.ffmpeg.org/ffmpeg/trunk
---
 libavcodec/interplayvideo.c | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'libavcodec')

diff --git a/libavcodec/interplayvideo.c b/libavcodec/interplayvideo.c
index f354b734c3..06816ba3e9 100644
--- a/libavcodec/interplayvideo.c
+++ b/libavcodec/interplayvideo.c
@@ -900,6 +900,11 @@ static int ipvideo_decode_frame(AVCodecContext *avctx,
     IpvideoContext *s = avctx->priv_data;
     AVPaletteControl *palette_control = avctx->palctrl;
 
+    /* compressed buffer needs to be large enough to at least hold an entire
+     * decoding map */
+    if (buf_size < s->decoding_map_size)
+        return buf_size;
+
     s->decoding_map = buf;
     s->buf = buf + s->decoding_map_size;
     s->size = buf_size - s->decoding_map_size;
-- 
cgit v1.2.3