diff options
| author | Vitor Sessak <vitor1001@gmail.com> | 2009-05-17 09:48:12 +0000 |
|---|---|---|
| committer | Vitor Sessak <vitor1001@gmail.com> | 2009-05-17 09:48:12 +0000 |
| commit | a2c4b2cc9a794006318d3d4c24c324bb7810f9d6 (patch) | |
| tree | 25fa4ecc0ae9809849e4122a7bd1f35b79da514a /libavcodec/tmv.c | |
| parent | 936bb4a9bc4f170ac5b792e167a6b1fce81f301c (diff) | |
| download | ffmpeg-a2c4b2cc9a794006318d3d4c24c324bb7810f9d6.tar.gz | |
Make TMV decoder check packet sizes before reading from it.
FATE test 295 might need updating.
Originally committed as revision 18862 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/tmv.c')
| -rw-r--r-- | libavcodec/tmv.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/libavcodec/tmv.c b/libavcodec/tmv.c index 7bca0868c6..5f746d5fb3 100644 --- a/libavcodec/tmv.c +++ b/libavcodec/tmv.c @@ -52,6 +52,13 @@ static int tmv_decode_frame(AVCodecContext *avctx, void *data, return -1; } + if (avpkt->size < 2*char_rows*char_cols) { + av_log(avctx, AV_LOG_ERROR, + "Input buffer too small, truncated sample?\n"); + *data_size = 0; + return -1; + } + tmv->pic.pict_type = FF_I_TYPE; tmv->pic.key_frame = 1; dst = tmv->pic.data[0]; |