aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec
diff options
context:
space:
mode:
authorAndreas Rheinhardt <andreas.rheinhardt@outlook.com>2020-05-28 15:53:56 +0200
committerAndreas Rheinhardt <andreas.rheinhardt@outlook.com>2022-03-31 10:48:50 +0200
commitd20ef30f534151ce749b064034c339562724cc34 (patch)
tree88531ca9ad6b589647d49eb40ea86e2daa076b41 /libavcodec
parentc12e8c97b13f33897bd9c6095432c9740504f5c7 (diff)
downloadffmpeg-d20ef30f534151ce749b064034c339562724cc34.tar.gz
avcodec/vp9_superframe_split_bsf: Discard invalid zero-sized frames
They are invalid in VP9. If any of the frames inside a superframe had a size of zero, the code would either read into the next frame or into the superframe index; so check for the length to stop this. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Diffstat (limited to 'libavcodec')
-rw-r--r--libavcodec/vp9_superframe_split_bsf.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/vp9_superframe_split_bsf.c b/libavcodec/vp9_superframe_split_bsf.c
index 2a068a6898..98f5cc83d0 100644
--- a/libavcodec/vp9_superframe_split_bsf.c
+++ b/libavcodec/vp9_superframe_split_bsf.c
@@ -70,7 +70,7 @@ static int vp9_superframe_split_filter(AVBSFContext *ctx, AVPacket *out)
frame_size |= bytestream2_get_byte(&bc) << (j * 8);
total_size += frame_size;
- if (frame_size < 0 || total_size > in->size - idx_size) {
+ if (frame_size <= 0 || total_size > in->size - idx_size) {
av_log(ctx, AV_LOG_ERROR,
"Invalid frame size in a superframe: %d\n", frame_size);
ret = AVERROR(EINVAL);