diff options
| author | Anton Khirnov <anton@khirnov.net> | 2013-04-09 20:33:25 +0200 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2013-05-09 20:05:53 +0200 |
| commit | 9b052bfb8609f2279c33dc9aa9fb39d2e7a53ef2 (patch) | |
| tree | dd5f4fd989c95dc23deab5f1b9e704ac726cf67c | |
| parent | 76c97f19634fb43c265ce33d9bce10f908cdc26c (diff) | |
| download | ffmpeg-9b052bfb8609f2279c33dc9aa9fb39d2e7a53ef2.tar.gz | |
rv10: check that extradata is large enough
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 01d376f598fe95478036f5d1e3e5e14ffe32d4bf)
Conflicts:
libavcodec/rv10.c
| -rw-r--r-- | libavcodec/rv10.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/rv10.c b/libavcodec/rv10.c index 8d5b62f925..bd58dec549 100644 --- a/libavcodec/rv10.c +++ b/libavcodec/rv10.c @@ -345,6 +345,11 @@ static int rv20_decode_picture_header(MpegEncContext *s) f= get_bits(&s->gb, av_log2(v)+1); if(f){ + if (s->avctx->extradata_size < 8 + 2 * f) { + av_log(s->avctx, AV_LOG_ERROR, "Extradata too small.\n"); + return AVERROR_INVALIDDATA; + } + new_w= 4*((uint8_t*)s->avctx->extradata)[6+2*f]; new_h= 4*((uint8_t*)s->avctx->extradata)[7+2*f]; }else{ |