aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/exr.c
diff options
context:
space:
mode:
authorPaul B Mahol <onemda@gmail.com>2013-02-24 14:10:20 +0000
committerPaul B Mahol <onemda@gmail.com>2013-02-24 14:27:39 +0000
commit7b12554c5abca0eb63ddbdfdf6f11c76b9230a0c (patch)
tree9a7ddb770e784d6f659eba7941c10360f6d62fcd /libavcodec/exr.c
parent74a78bfe6c1bc0f5b9d34979fc081dcb75c0ae03 (diff)
downloadffmpeg-7b12554c5abca0eb63ddbdfdf6f11c76b9230a0c.tar.gz
exr: make sure that data_size is not bigger than expected
Signed-off-by: Paul B Mahol <onemda@gmail.com>
Diffstat (limited to 'libavcodec/exr.c')
-rw-r--r--libavcodec/exr.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/libavcodec/exr.c b/libavcodec/exr.c
index 59144a2d8d..cef5e0c612 100644
--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -270,7 +270,8 @@ static int decode_block(AVCodecContext *avctx, void *tdata,
uncompressed_size = s->scan_line_size * FFMIN(s->scan_lines_per_block, s->ymax - line + 1);
if ((s->compr == EXR_RAW && (data_size != uncompressed_size ||
line_offset > buf_size - uncompressed_size)) ||
- (s->compr != EXR_RAW && line_offset > buf_size - data_size)) {
+ (s->compr != EXR_RAW && (data_size > uncompressed_size ||
+ line_offset > buf_size - data_size))) {
return AVERROR_INVALIDDATA;
}