diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-05-13 00:41:38 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-06-10 02:13:11 +0200 |
| commit | 0bf455c0543dca474088e3ef004904a747555bec (patch) | |
| tree | 5fbbca451bec0121ab50d37a479a037a76d67d25 | |
| parent | e553282860c805679349af521af96e1e7886e713 (diff) | |
| download | ffmpeg-0bf455c0543dca474088e3ef004904a747555bec.tar.gz | |
avcodec/vqavideo: Check chunk size
Fixes CID1239154
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8a62b80ce6c8e87e7937f9a5d68f83882c1c8da2)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/vqavideo.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavcodec/vqavideo.c b/libavcodec/vqavideo.c index 0a2b668d29..7282cf9ddb 100644 --- a/libavcodec/vqavideo.c +++ b/libavcodec/vqavideo.c @@ -231,6 +231,12 @@ static int decode_format80(VqaContext *s, int src_size, unsigned char color; int i; + if (src_size < 0 || src_size > bytestream2_get_bytes_left(&s->gb)) { + av_log(s->avctx, AV_LOG_ERROR, "Chunk size %d is out of range\n", + src_size); + return AVERROR_INVALIDDATA; + } + start = bytestream2_tell(&s->gb); while (bytestream2_tell(&s->gb) - start < src_size) { opcode = bytestream2_get_byte(&s->gb); |