aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/dfa.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2012-09-30 13:52:48 +0200
committerMichael Niedermayer <michaelni@gmx.at>2012-09-30 13:52:48 +0200
commite5ce6d447b952658b8a8568c807baeab5cf58783 (patch)
tree74af04c23abf7c610e0e944a7df4c7ca87f67a2f /libavcodec/dfa.c
parent301f6da0397eb8955adf355229521997390d918a (diff)
parentd05f72c75445969cd7bdb1d860635c9880c67fb6 (diff)
downloadffmpeg-e5ce6d447b952658b8a8568c807baeab5cf58783.tar.gz
Merge commit 'd05f72c75445969cd7bdb1d860635c9880c67fb6'
* commit 'd05f72c75445969cd7bdb1d860635c9880c67fb6': dfa: improve boundary checks in decode_dds1() wmalosslessdec: Fix reading too many bits in decode_channel_residues() wmalosslessdec: fix a get_bits(0) in decode_ac_filter wmalosslessdec: make MCLMS arrays big enough for what is written into them. indeo4/5: check empty tile size in decode_mb_info(). ivi_common: make ff_ivi_process_empty_tile() static. indeo5: check tile size in decode_mb_info(). indeo3: fix out of cell write. Conflicts: libavcodec/dfa.c libavcodec/indeo3.c libavcodec/indeo5.c libavcodec/ivi_common.c libavcodec/wmalosslessdec.c Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/dfa.c')
-rw-r--r--libavcodec/dfa.c10
1 files changed, 6 insertions, 4 deletions
diff --git a/libavcodec/dfa.c b/libavcodec/dfa.c
index e4b940cc60..115973132f 100644
--- a/libavcodec/dfa.c
+++ b/libavcodec/dfa.c
@@ -157,8 +157,7 @@ static int decode_dds1(GetByteContext *gb, uint8_t *frame, int width, int height
bitbuf = bytestream2_get_le16u(gb);
mask = 1;
}
- if (frame_end - frame < width + 2)
- return AVERROR_INVALIDDATA;
+
if (bitbuf & mask) {
v = bytestream2_get_le16(gb);
offset = (v & 0x1FFF) << 2;
@@ -172,9 +171,12 @@ static int decode_dds1(GetByteContext *gb, uint8_t *frame, int width, int height
frame += 2;
}
} else if (bitbuf & (mask << 1)) {
- frame += bytestream2_get_le16(gb) * 2;
+ v = bytestream2_get_le16(gb)*2;
+ if (frame - frame_end < v)
+ return AVERROR_INVALIDDATA;
+ frame += v;
} else {
- if (frame_end - frame < width + 2)
+ if (frame_end - frame < width + 3)
return AVERROR_INVALIDDATA;
frame[0] = frame[1] =
frame[width] = frame[width + 1] = bytestream2_get_byte(gb);