Signed-off-by: Michael Niedermayer <[email protected]>
---
libavcodec/rtv1.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/libavcodec/rtv1.c b/libavcodec/rtv1.c
index 4b202e6a21..95fa9210d8 100644
--- a/libavcodec/rtv1.c
+++ b/libavcodec/rtv1.c
@@ -44,6 +44,8 @@ static int decode_rtv1(GetByteContext *gb, uint8_t *dst,
ptrdiff_t linesize,
uint8_t block[8] = { 0 };
int run = 0;
+ if (bytestream2_get_bytes_left(gb) < (width / 4) * (height / 4) / 0xFFFF *
4)
+ return AVERROR_INVALIDDATA;
for (int y = 0; y < height; y += 4) {
for (int x = 0; x < width * 4; x += 16) {
int mode = 0;
@@ -126,7 +128,9 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *p,
dst = p->data[0] + p->linesize[0] * (avctx->coded_height - 1);
linesize = -p->linesize[0];
- decode_rtv1(&gb, dst, linesize, width, height, flags, dsp->dxt1_block);
+ ret = decode_rtv1(&gb, dst, linesize, width, height, flags,
dsp->dxt1_block);
+ if (ret < 0)
+ return ret;
p->pict_type = AV_PICTURE_TYPE_I;
p->flags |= AV_FRAME_FLAG_KEY;
--
2.17.1
_______________________________________________
ffmpeg-devel mailing list
[email protected]
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
[email protected] with subject "unsubscribe".
