Merge commit 'af9b62654d5aa023a96906215365532d18541a09' into release/1.1

* commit 'af9b62654d5aa023a96906215365532d18541a09':
  svq1: do not modify the input packet

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 23 insertions, 1 deletions

diff --git a/libavcodec/svq1dec.c b/libavcodec/svq1dec.c
index 05da1b0aa9..9aac8c74c4 100644
--- a/libavcodec/svq1dec.c
+++ b/libavcodec/svq1dec.c
@@ -61,6 +61,10 @@ typedef struct SVQ1Context {
     DSPContext dsp;
     GetBitContext gb;
     AVFrame *cur, *prev;
+
+    uint8_t *pkt_swapped;
+    int pkt_swapped_allocated;
+
     int width;
     int height;
     int frame_code;
@@ -628,7 +632,24 @@ static int svq1_decode_frame(AVCodecContext *avctx, void *data,
 
     /* swap some header bytes (why?) */
     if (s->frame_code != 0x20) {
-        uint32_t *src = (uint32_t *)(buf + 4);
+        uint32_t *src;
+
+        if (buf_size < 9 * 4) {
+            av_log(avctx, AV_LOG_ERROR, "Input packet too small\n");
+            return AVERROR_INVALIDDATA;
+        }
+
+        av_fast_malloc(s->pkt_swapped, &s->pkt_swapped_allocated,
+                       buf_size);
+        if (!s->pkt_swapped)
+            return AVERROR(ENOMEM);
+
+        memcpy(s->pkt_swapped, buf, buf_size);
+        buf = s->pkt_swapped;
+        init_get_bits(&s->gb, buf, buf_size * 8);
+        skip_bits(&s->gb, 22);
+
+        src = (uint32_t *)(s->pkt_swapped + 4);
 
         if (buf_size < 36)
             return AVERROR_INVALIDDATA;
@@ -804,6 +825,7 @@ static av_cold int svq1_decode_end(AVCodecContext *avctx)
         avctx->release_buffer(avctx, s->prev);
     avcodec_free_frame(&s->cur);
     avcodec_free_frame(&s->prev);
+    av_freep(&s->pkt_swapped);
 
     return 0;
 }