diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-09-10 20:52:48 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-09-10 20:52:48 +0200 |
| commit | 7db7eb08e051d0d95215f645e0cfa9a5879cded0 (patch) | |
| tree | 62fb724f4bc8fd03e521ef797d42e61708310f14 /libavcodec/indeo2.c | |
| parent | 60599c68b04ec9d8b09750dd3f45f6ce92e61d35 (diff) | |
| parent | 8bfea4ab4e2cb32bc7bf6f697ee30a238c65d296 (diff) | |
| download | ffmpeg-7db7eb08e051d0d95215f645e0cfa9a5879cded0.tar.gz | |
Merge remote-tracking branch 'qatar/master'
* qatar/master:
Fixed segfault with wavpack decoder on corrupted decorrelation terms sub-blocks.
avconv: move audio_channels to the options context.
avconv: move *_disable to options context.
avconv: remove -[vas]lang options.
avconv: move codec tags to options context.
cljr: init_get_bits size in bits instead of bytes
indeo2: fail if input buffer too small
indeo2: init_get_bits size in bits instead of bytes
ffv1: Fixed size given to init_get_bits() in decoder.
Conflicts:
avconv.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/indeo2.c')
| -rw-r--r-- | libavcodec/indeo2.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/libavcodec/indeo2.c b/libavcodec/indeo2.c index 30d4758064..f7798e307d 100644 --- a/libavcodec/indeo2.c +++ b/libavcodec/indeo2.c @@ -153,6 +153,13 @@ static int ir2_decode_frame(AVCodecContext *avctx, return -1; } + start = 48; /* hardcoded for now */ + + if (start >= buf_size) { + av_log(s->avctx, AV_LOG_ERROR, "input buffer size too small (%d)\n", buf_size); + return AVERROR_INVALIDDATA; + } + s->decode_delta = buf[18]; /* decide whether frame uses deltas or not */ @@ -160,9 +167,8 @@ static int ir2_decode_frame(AVCodecContext *avctx, for (i = 0; i < buf_size; i++) buf[i] = av_reverse[buf[i]]; #endif - start = 48; /* hardcoded for now */ - init_get_bits(&s->gb, buf + start, buf_size - start); + init_get_bits(&s->gb, buf + start, (buf_size - start) * 8); if (s->decode_delta) { /* intraframe */ ir2_decode_plane(s, avctx->width, avctx->height, |