diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2018-06-24 02:43:18 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2018-09-12 00:52:01 +0200 |
| commit | 74af6ae02100ff05f8a09fde5db4cd06509cdfba (patch) | |
| tree | 547a1f3484e1bd7c41fd92615a2439e366e05ce7 /libavcodec/vp8.c | |
| parent | 09f0429b9961ea77a60b07afb62082e5565decd4 (diff) | |
| download | ffmpeg-74af6ae02100ff05f8a09fde5db4cd06509cdfba.tar.gz | |
avcodec/vp8: Check bitstream input in vp7_fade_frame() before time consuming operation
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/vp8.c')
| -rw-r--r-- | libavcodec/vp8.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/vp8.c b/libavcodec/vp8.c index 3adfeac3d9..a06692c476 100644 --- a/libavcodec/vp8.c +++ b/libavcodec/vp8.c @@ -507,6 +507,9 @@ static int vp7_fade_frame(VP8Context *s, VP56RangeCoder *c) int beta = (int8_t) vp8_rac_get_uint(c, 8); int ret; + if (c->end <= c->buffer && c->bits >= 0) + return AVERROR_INVALIDDATA; + if (!s->keyframe && (alpha || beta)) { int width = s->mb_width * 16; int height = s->mb_height * 16; |