diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-12-28 19:05:16 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-12-28 19:05:16 +0100 |
| commit | 8e09482e4d27d65bbce2ce5c2f4392216011ed09 (patch) | |
| tree | d8c91caa82921f379235d6f15c843771ea67896d | |
| parent | 11ca3416f92744f376c08e5f31bcbe5d9b44acb2 (diff) | |
| download | ffmpeg-8e09482e4d27d65bbce2ce5c2f4392216011ed09.tar.gz | |
vcr1dec: Check that there is sufficient input data.
Fixes crash.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/vcr1.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/vcr1.c b/libavcodec/vcr1.c index 73a7226523..1526215314 100644 --- a/libavcodec/vcr1.c +++ b/libavcodec/vcr1.c @@ -56,6 +56,11 @@ static int decode_frame(AVCodecContext *avctx, if(p->data[0]) avctx->release_buffer(avctx, p); + if(buf_size < 16 + avctx->height + avctx->width*avctx->height*5/8){ + av_log(avctx, AV_LOG_ERROR, "Insufficient input data.\n"); + return AVERROR(EINVAL); + } + p->reference= 0; if(avctx->get_buffer(avctx, p) < 0){ av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n"); |