diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-05-07 19:11:01 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-05-07 19:11:01 +0200 |
| commit | daea3209693f28328ca553fb33fdf8fc2ab42044 (patch) | |
| tree | 324e97d75f4974a801c6dbd98befb894816e9812 | |
| parent | 873d7e0e632645e67fdfd0e35fb27d477b11307a (diff) | |
| download | ffmpeg-daea3209693f28328ca553fb33fdf8fc2ab42044.tar.gz | |
avcodec/txd: Fix input size checks for dxt1/3 for dimensions % 4 != 0
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/txd.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/txd.c b/libavcodec/txd.c index ad1a0152f4..d2884ad1c6 100644 --- a/libavcodec/txd.c +++ b/libavcodec/txd.c @@ -94,12 +94,12 @@ static int txd_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, if (!(flags & 1)) goto unsupported; case FF_S3TC_DXT1: - if (bytestream2_get_bytes_left(&gb) < (w/4) * (h/4) * 8) + if (bytestream2_get_bytes_left(&gb) < FF_CEIL_RSHIFT(w, 2) * FF_CEIL_RSHIFT(h, 2) * 8) return AVERROR_INVALIDDATA; ff_decode_dxt1(&gb, ptr, w, h, stride); break; case FF_S3TC_DXT3: - if (bytestream2_get_bytes_left(&gb) < (w/4) * (h/4) * 16) + if (bytestream2_get_bytes_left(&gb) < FF_CEIL_RSHIFT(w, 2) * FF_CEIL_RSHIFT(h, 2) * 16) return AVERROR_INVALIDDATA; ff_decode_dxt3(&gb, ptr, w, h, stride); break; |