diff options
| author | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2022-11-19 02:03:05 +0100 |
|---|---|---|
| committer | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2022-11-23 22:44:09 +0100 |
| commit | 715bf3509a96ee679449c0ba479b500fa646c217 (patch) | |
| tree | f5e2c606a4d081dd65f524ff876b22b676bb07ef /libavcodec | |
| parent | 14c60935280d81d333ba9e19f0ebd39f16d8c778 (diff) | |
| download | ffmpeg-715bf3509a96ee679449c0ba479b500fa646c217.tar.gz | |
avcodec/pnmenc: Check av_image_get_buffer_size()
Fixes the crash in ticket #10050.
Also ensure that we don't overflow before ff_get_encode_buffer().
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/pnmenc.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/pnmenc.c b/libavcodec/pnmenc.c index 9eb663306d..c998dd410c 100644 --- a/libavcodec/pnmenc.c +++ b/libavcodec/pnmenc.c @@ -42,7 +42,10 @@ static int pnm_encode_frame(AVCodecContext *avctx, AVPacket *pkt, int size = av_image_get_buffer_size(avctx->pix_fmt, avctx->width, avctx->height, 1); - if ((ret = ff_get_encode_buffer(avctx, pkt, size + 200, 0)) < 0) + if (size < 0) + return size; + + if ((ret = ff_get_encode_buffer(avctx, pkt, size + 200U, 0)) < 0) return ret; bytestream_start = |