diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-03-10 18:39:02 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-03-10 18:39:02 +0100 |
| commit | 5640ea43d7202e6bc6bc032079f66456323d1008 (patch) | |
| tree | 88b6869c593b55a917214610557cc087a11fb007 /libavcodec/truemotion1.c | |
| parent | 15efd9a7c0a6ccc59c07c3118a2e075449c91e68 (diff) | |
| parent | 2c1d84499bfe06d75e9160b824eeffd9f5587337 (diff) | |
| download | ffmpeg-5640ea43d7202e6bc6bc032079f66456323d1008.tar.gz | |
Merge commit '2c1d84499bfe06d75e9160b824eeffd9f5587337' into release/0.10
* commit '2c1d84499bfe06d75e9160b824eeffd9f5587337':
lagarith: pad RGB buffer by 1 byte.
truemotion1: check the header size
shorten: pad the internal bitstream buffer
samplefmt: avoid integer overflow in av_samples_get_buffer_size()
h264: Fix a typo from the previous commit
h264: Lower bound check for slice offsets
rpza: limit the number of blocks to the total remaining blocks in the frame
Conflicts:
libavcodec/lagarith.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/truemotion1.c')
| -rw-r--r-- | libavcodec/truemotion1.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/truemotion1.c b/libavcodec/truemotion1.c index 4576aa0c8e..ecf27aa8d8 100644 --- a/libavcodec/truemotion1.c +++ b/libavcodec/truemotion1.c @@ -320,6 +320,11 @@ static int truemotion1_decode_header(TrueMotion1Context *s) return -1; } + if (header.header_size + 1 > s->size) { + av_log(s->avctx, AV_LOG_ERROR, "Input packet too small.\n"); + return AVERROR_INVALIDDATA; + } + /* unscramble the header bytes with a XOR operation */ memset(header_buffer, 0, 128); for (i = 1; i < header.header_size; i++) |